Firewall is one of those words that appears in security marketing without a definition. Several different things carry the name and they do different jobs.
The network firewall
Sits between your network and the internet and decides which connections are allowed. Traditionally by port and address – allow web traffic, block everything else.
Your home router has one, which is why devices on your network are not directly reachable from outside. That single default does most of the protective work people attribute to security products.
The host firewall
Runs on the computer itself, controlling what that machine accepts and what programs can reach the network. Useful because it protects against threats already inside the network, which the perimeter firewall does not see.
The web application firewall
Sits in front of a website and inspects the content of requests, looking for attack patterns – attempts at injection, known exploit signatures, suspicious behaviour.
This is the type that matters for anyone running a site. It blocks a large volume of automated attack traffic that would otherwise reach the application.
What firewalls do not do
Stop you from installing something malicious. Protect against attacks that arrive through allowed channels, which is most of them now. Or prevent a compromise from an insider.
The perimeter model assumed threats were outside and everything inside was trusted. That assumption stopped being useful when work moved off the network.
The practical version
Home users have one and should leave it on. Website operators need the application layer. Neither replaces keeping software updated, which prevents more incidents than any filtering.