WAF supports access control over content at the application layer. HTTP and HTTPS are both application layer protocols.