Our site recently got hacked and after hardening the site we installed a web application firewall.
My question is does a web application firewall negatively impact SEO and rankings? I.e. in terms of rankings, speed and crawl-ability?
Not having one can affect SEO, and here's why:
If your site were to be hacked or compromised - it's possible that this would affect your search engine position. A site being offline for any period of time (due to a compromise/hacking attempt) will result in search engines lowering the ranking due to it being inaccessible. Google can also detect sites infected with malware and these are heavily penalised in terms of SEO - to the point users are warned not to access them.
Most search engines base their rankings on various factors, which includes the security of a website. For example, sites which are not served over HTTPS** were historically given a lower ranking, especially if they were deemed to be handling customer information - e.g. ecommerce.
Therefore, not having a firewall can negatively affect your SEO.
From a technical perspective there are only 2 things which having one might affect it:
Blocking search engine crawlers. No application firewall (hardware or software) does this by default.
If the incoming http requests were processed less quickly due to the firewall rules, this may incur a penalty since search engines give preferences to sites which load quickly. However, no firewall in a default configuration - or with average rules being applied - would make any significant difference in terms of page load time.
** the HTTP vs HTTPS issue has nothing to do with a firewall but illustrates other aspects of web security that search engines take into account
TL/DR: if your site is infected with malware and/or offline for extended periods, that will definitely have a negative affect on your search engine position. Therefore not using things to prevent that (like a firewall) can have a negative impact.
Hard to tell without more information. However, the only thing that could impact SEO is if your firewall is messing with the following points:
As long as your source code/rendered page is accessible by searchers you should not have any problems.