A filter between your application and hostile traffic
A web application firewall inspects each HTTP request and blocks common attacks before they reach your code. We set it up, tune it to your application and keep it maintained.
What is included
- Managed rule sets
- We turn on rules that cover the OWASP Top 10 attack classes and known exploits.
- Custom rules
- We write rules for your own paths, parameters and admin areas.
- Rate limiting
- We cap request rates on logins, search, forms and APIs to slow brute force and scraping.
- Bot filtering
- We tell real browsers apart from automated clients and challenge or block the clients you do not want.
- Tuning and exceptions
- We review blocked requests, fix false positives and record each exception.
- Event review
- You get access to the security event log and a periodic summary of what the WAF blocked.
How it works
Map. We list your domains, endpoints, APIs and normal traffic patterns.
What you receiveA protection plan that shows what will be filtered and where.
Monitor mode. The WAF logs what it would block without stopping any traffic.
What you receiveA review of likely false positives before enforcement starts.
Enforce. We switch rules to block or challenge, one group at a time.
What you receiveAn active WAF and a record of every rule and exception.
Maintain. We follow rule updates, new endpoints and attack trends.
What you receiveA monthly summary and changes made on request.
Right for you if
Your application handles logins, payments or personal data.
You run older code that cannot be patched quickly.
Bots are scraping, filling forms or trying passwords on your site.
Questions
Does a WAF replace fixing vulnerabilities in our code?
No. It reduces exposure while fixes are made, and the code still needs to be corrected.
Will real users get blocked?
That can happen during setup, so we start in monitor mode and tune the rules before we block anything.
Does it protect APIs as well?
Yes. We add rules and rate limits for API endpoints alongside the website.
Will it slow down our site?
Inspection adds a small amount of processing per request. We measure response times before and after setup.