A shield in front of public sites. We run it.
Agency and public sites have to stay up — permit forms, benefits applications, notices. We put a managed web application firewall in front, watch, then block. Same product, same trial.
Public forms that can't go down
A blocked permit or benefits form is an outage the public notices. Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
Promote Copilot is included — you still click once. Nothing is blocked on day one — a false positive is not an overnight outage.
Operator deep-dive on scrapers, form spam, and credential stuffing: WAF bot management for campus and agency sites.
If the event is availability — a flood on the VIP, not a false-positive ticket — start with the first-hour playbook.
Friday CMS CVE week: same emergency virtual-patch runbook — count first, then promote while agency CMS teams patch.
Drupal and WordPress estates
Public-sector sites are often Drupal or WordPress — sometimes dozens of them. We sit in front via DNS. No module, no plugin, hosting stays put.
One shield per site. We run it.
Same product, same trial
$150/site/mo, 14-day trial. We put the shield up, watch, then block — the same way we do for every other site.
Experience protecting higher-education and public-sector sites.
For the longer operator cut — city website firewall, public sector WAF false positives, and origin lock-down — read Managed WAF for government websites.
Related
- Managed WAF for government websites
- A managed WAF for your Drupal site
- Managed WAF for university and college websites
- A managed WAF for your WordPress site
- What is WAF count mode? (and why you start there)
- What's safe to block on a WAF?
- WAF false positives on forms: stop blocking legitimate POSTs
- WAF bot management for campus and agency sites
- Emergency virtual patching when a CMS CVE drops
- Hide your origin IP behind a WAF (and allowlist edge IPs only)
- Campus DDoS response: keep .edu sites up under flood
- DIY WAF vs managed: console burden or operator?
- Managed WAF for multi-site teams
- Pricing
- Free security scan
- A client was taking 90 million requests an hour. The WAF was only half the fight.
- WAF Watch: Events Calendar RCE, Elementor uploads, Drupal table field