What is included

A firewall does not replace secure development, but it buys time: a vulnerability can be closed by a rule today and fixed in the code in the next release.

Discuss the scope

Request filtering

Blocking common attacks: database code injection, cross site scripting, path traversal.

Protection against guessing

Limiting login attempts, protecting the login and password recovery forms.

Cutting off bots

Distinguishing search engine crawlers, scrapers and malicious automation.

Virtual patches

Closing a discovered vulnerability with a rule before the developers release a fix.

Form protection

Filtering spam and automated submissions without harming genuine enquiries.

Reporting

What was blocked, from where and under which rules.

How the work runs

Deployment takes a few days upwards. Most of the time goes not on installation but on tuning the rules for the specific site.

01

Survey

We look at what the application is, which forms it has, how login works, which integrations and customer accounts exist.

02

Observation mode

The firewall is switched on without blocking and builds a picture of the real traffic.

03

Rule tuning

We remove the false positives. On a live site there are always plenty.

04

Blocking and control

We switch to enforcement mode, configure notifications and set up regular report reviews.

Switching a firewall straight into blocking mode is dangerous. Legitimate requests on your own site can look suspicious to generic rules, and the order forms are the first to suffer. A week of observation before enforcement saves both nerves and orders.

Frequently asked questions

A popular platform means its vulnerabilities are hunted for in bulk and automatically. A firewall is especially useful precisely for widespread systems: it closes known attacks before you have time to install the update.

Only slightly, usually a few milliseconds. Cloud solutions often speed delivery up instead, thanks to caching and a distributed network.

No. A firewall filters known attack patterns but it cannot see logical vulnerabilities in the business logic. Applications with customer accounts and payments need an audit as well.

We will protect your website

Tell us what the application is and which platform it runs on. We will choose a solution and tune the rules to your traffic.