This paper presents the design and implementation of a Web Application Firewall (WAF) using machine learning models to effectively detect and mitigate three prominent web security threats: Distributed Denial-of-Service (DDoS), SQL injection, and Cross-Site Scripting (XSS). The proposed system leverages separate machine learning models for each attack type, optimizing detection by focusing on specific features unique to each threat. By analyzing traffic behavior, request payloads, and input structures, the WAF ensures high accuracy in identifying and blocking malicious activities. This multi-model approach significantly reduces false positives and enhances real-time protection. The solution is scalable and can adapt to evolving attack patterns, providing robust security for modern web applications and critical infrastructure.