Managed WAF for campus and public-sector websites.
Review suspicious traffic before you block it.
Protect admissions, public services, and department websites on their existing hosting. We set up the shield; your team approves blocking changes. Guided DNS setup, with concierge help when the zone is not yours to edit.
See the AdvisorExplore the campus example
Start a 14-day trial · $150/site/mo
Card at Stripe checkout. Cancel before the 14-day trial ends and you won't be charged.
Campus example · WordPress and WooCommerce example · example Tuning panel. Fictional sites, with interactive examples.
WAF Cybersecurity Advisor
The Advisor reads your count window and explains what's safe to promote — you still click once. Rule-based checks on your own site's logs — the same evidence always gives the same answer.
Setup and tuning help
We provision the shield and issue SSL. Guided DNS setup, with concierge help when the zone is not yours.
Full managed WAF
SQL injection, XSS, known exploits, and IP reputation start in count. Bot management and account-fraud protection are available after you set them up. You promote later.
Free auto SSL
A free TLS certificate is issued and renewed for you. Visitors get HTTPS automatically.
Human support
Email support@wafcybersecurity.com. We provision and maintain the shield, help with DNS, and review tuning when you request it. You approve blocking changes. Support is by email; we are not watching every site around the clock.
Custom rules
Block by country or IP, allow-list trusted clients, rate-limit abuse — next to managed rules.
Protected in three steps
Start with one public website and include the person who manages its DNS.
- 01
Add your site
Domain and where it is hosted. We stand up the edge and issue SSL. Your server and code stay put.
- 02
Guided DNS
We show the certificate and traffic records. Paste them, connect a provider, or ask for concierge help.
- 03
Count, then promote
Watch at least a day of traffic. Test sign-in, forms, and other important paths, then approve a rule or keep it in count.
Recommendations reflect the traffic we observed. A quiet window cannot prove an untested login, form, or seasonal workflow will work. Review those paths before promoting.
Scan your site — free first if you want the grade before an account. The trial on the report prefills that domain.
Before you buy
No customer logos and no compliance badge. These are the pages you can check.
Who runs it
A sole proprietorship. Email support@wafcybersecurity.com — the contact on the terms, privacy policy, and SLA.
What we log
Authorization and cookie values are redacted before a request is logged.
How to reach a human
Email. Concierge DNS is typically about one business day once access is clear — not a clock-hour promise.
Uptime
99.9% monthly edge availability for Live sites, with a service credit if we miss it.
Compared with doing it yourself
We handle shield setup and turn traffic observations into rule-by-rule recommendations. Your team keeps control of the decision.
A console you run
You build the distribution, certificate, and rule list, then decide what to flip.
A platform you configure
Many products. You choose what to log, what to block, and when to tune. Prices are on the comparison.
This product
We provision and start in count. After about a day the dashboard names Promote, Hold, or Needs allowlist.
Baseline managed rules in count, custom IP/geo/rate rules, bot and account-fraud protection when you set them up, the Advisor, free SSL, Slack/email spike alerts, live dashboard. 14-day trial.
Start a 14-day trialCard at Stripe checkout. Cancel before the trial ends and you won't be charged.
Who this is for
Campus, public-sector, and web teams — including WordPress shops. Fictional WooCommerce store.
Campuses
Enrollment, athletics, news, and departmental sites that need a shield without another console for IT to run.
Public agencies
Public-facing sites where downtime and defacement are not an option. We run the shield; your team keeps the site.
Web teams with too many sites
Too many domains, not enough people to babysit a firewall. Add a site, point DNS, then see what's safe to block.
Guides
Practical guides for setup, tuning, and day-to-day operations.
All guides
Count mode, false positives, virtual patching, and platform explainers.
Product docs
How onboarding, the Advisor, alerts, and billing work today.
How count mode works
Observe traffic before deciding whether to block.
What's safe to block
How to read a count window without breaking forms.
What is the WAF Cybersecurity Advisor?
How the Advisor turns observed traffic into a recommendation.
Questions, answered
Do I have to move my website?
No. We sit in front of your existing site via DNS — your server, hosting, and code stay exactly where they are.
Will it slow my site down?
No noticeable impact. Traffic runs through a global edge, milliseconds from visitors. Clean requests pass straight through to your origin.
What if a rule blocks a real customer?
New protections start in count for 24 hours — they watch without blocking — then you promote to block. The Advisor explains the count window; you still click once. It never auto-blocks. You're always in control per rule. See how count mode works and what a branded 403 looks like.
Can I keep my own DNS provider?
Yes. CNAME mode keeps your provider. Or pick managed DNS, delegate nameservers once, and we handle SSL and routing.
Is my traffic data private?
Authorization and cookie headers are redacted before anything is logged. We keep what's needed for blocked attacks and traffic stats.
What if my site gets a lot of traffic?
300 GB and 5 million requests a month included. Extra traffic is $0.15/GB and $3 per million requests. You see live usage; we email before overage adds up.
Can I cancel anytime?
Yes — month to month, $150 per protected site. Remove a site and billing follows.
Can I get Slack or webhook alerts?
Yes. Email is on by default. Add a Slack incoming webhook or any HTTPS webhook on the Alerts page.
Do you have an uptime SLA?
Yes — 99.9% monthly edge availability for Live sites, with service credits if we miss it. Origin downtime, DNS/registrar mistakes, and regional edge outages are excluded. Details on the SLA.
What engine sits in front of the site?
AWS WAF on CloudFront. We provision and tune it; you change DNS — or we do.
Who runs ProtectMyWebsite?
ProtectMyWebsite is a sole proprietorship. Email support@wafcybersecurity.com — that is the contact on the terms, privacy policy, and SLA. See security and support.
How is this different from AWS managed rules alone?
Same engine — AWS WAF on CloudFront — without you building the distribution, certificate, and Web ACL. Rules start in count. After 24 hours the dashboard names what's safe to block. You still click once. It never auto-blocks. See the console comparison.
How is this different from Cloudflare?
Cloudflare Business is a platform you configure, listed at $250 / month per zone, or $200/mo equivalent on annual prepay ($2,400/year). This is a managed WAF at $150/site/month. You do not get their full product suite. You get the shield, count-then-click, and email support. See the Cloudflare comparison.
Do you have SOC 2 or another certification?
No. We do not claim SOC 2, ISO 27001, FedRAMP, PCI DSS, or any other compliance certification. Read the security page, the privacy policy, and the SLA before a procurement review.
How do I reach a person?
Email support@wafcybersecurity.com. Concierge DNS, when you ask us to change DNS, is typically about one business day once access is clear — not a clock-hour promise. Campus teams who need an invoice use Campus Estate, which Mac invoices. Self-serve stays a card at Stripe.
$150/site/mo · 14-day trial