Service · Cyber security

Web application firewall (WAF)

A website is reachable by the whole internet around the clock, and automated scanners find it within hours of launch. A web application firewall filters out the standard attacks before they reach your code, whether the site runs on WordPress, WooCommerce, Shopify or a custom platform.

Send an enquiry See the scope

24/7

traffic filtering

Bots

kept out

Virtual patch

ahead of the fix

Reports

what and from where

What the service covers

A WAF is no substitute for careful development, but it buys time: a hole found today is closed with a rule now and fixed in code in the next release.

Talk it through with us

Filtering

Blocking of well-known attack types: SQL injection, cross-site scripting, path traversal and probing of admin pages.

Login protection

Limits on login attempts for wp-admin and customer accounts, plus protection of the »forgotten password« flow.

Bots

Search engines are let through while scrapers, stock-checking bots and malicious automation are kept out.

Virtual patching

A vulnerability in a plugin is closed with a rule until the vendor releases a fix.

Forms

Spam in contact and quote forms is filtered without losing genuine enquiries.

Reports

What was blocked, where it came from and which rule caught it, in a monthly summary.

How we deliver it

Connecting the WAF takes a few days, but tuning the rules to your site takes longer than the setup itself.

Analysis

Platform, forms, customer login, payments through Nets, Quickpay or Stripe, and integrations.

Learning mode

The WAF runs without blocking and builds a picture of genuine traffic.

Tuning

False positives are removed. A live site always has some.

Enforcement

Blocking is enabled, and alerts plus a regular review are put in place.

A new site is scanned before it receives its first real visitor. There is no need to wait for a targeted attack: bots try admin panel addresses and known flaws in popular plugins day and night. That is why the WAF goes in at launch rather than after the first incident.

Common questions

A cloud WAF is simpler, usually cheaper and speeds up the site through a CDN at the same time. A self-hosted WAF makes sense when rules forbid routing traffic through an outside service, or when the site is not public at all.

They are reviewed during the first month and the rules adjusted. They never vanish completely, but they can be brought down to the odd case. That is why we never skip learning mode.

No. A WAF gives you breathing space, not immunity. It stops known attack patterns but cannot see logic flaws in your own business rules. Updates still have to be installed.

A cloud WAF absorbs most simple application-layer flooding. Large volumetric attacks need the provider's DDoS protection, which can often be added from the same vendor.

Related services

View the whole area

Service GDPR and personal data security Access, logging and encryption for personal data Service Security policies and documentation Policies and procedures people can actually follow Service Security solution deployment Selecting, piloting and rolling out security tools Service Infrastructure protection Perimeter, network zones and secure remote access

Protect your website

Describe the site and its platform. We will pick a suitable WAF and tune the rules to your traffic.

Email
office@apply.dk

Coverage
All of Denmark, delivered remotely

I agree that Apply may handle my details as set out in the privacy policy