Guides

Free website security scan with no signup: what the WAF scan report grade checks, how to read an F, and the Protect {domain} path to a 14-day trial.

Count mode lets campus and agency teams put a WAF in front of production without blocking real users on day one — observe ~24 hours, then promote what's safe to block.

Promote Copilot is the AI layer on ProtectMyWebsite count mode: Promote, Hold, or Needs allowlist in plain English — you still click. Not an auto-block LLM firewall.

Learn what's safe to block on a managed WAF. Rules start in count; Promote Copilot explains Promote, Hold, or Needs allowlist — you still click once.

Managed WAF setup for campus and agency teams: what one DNS change means, CNAME vs apex, SSL, count mode day 0–24, and how long go-live actually takes.

Concierge DNS WAF setup for campus and agency teams who won’t touch DNS — we coordinate cutover (~one business day), CNAME vs nameserver, SSL handled, then count → promote.

DIY WAF vs managed for campus and agency teams. When console burden wins — and when managed WAF pricing is worth it vs running your own.

Honest managed WAF pricing guide: what $150/site/month includes, DIY people-cost vs fully managed WAF $150, and when campus teams should Talk to sales.

ProtectMyWebsite refer-a-friend: both sides get 10% off managed WAF for 3 months when your friend completes Checkout. Find your link, share your code, start a trial.

Campus DDoS response for .edu and agency sites — first-hour playbook, origin IP lock-down, count→promote during recovery, and status/comms when the flood hits.

Origin IP bypass DDoS walks around your edge. Hide the origin IP behind a WAF and allowlist edge IPs only — the durable fix for campus and agency sites.

Why WAFs block registration, admissions, and government forms — multipart uploads, CSRF tokens, odd field names, payment callbacks — and how count-first stopping of false positives works.

Donation form WAF false positives, university payment portal firewall, and giving day website WAF — count-first so payment callbacks and alumni gifts don’t break; bot stuffing on donate endpoints.

WAF SSO false positives, IdP callbacks blocked by WAF, and SAML CAS OIDC allowlists — count first so Monday login storms don’t brick university and agency SSO.

WAF bot management for campuses and agencies — stop scrapers, admissions form spam, and credential stuffing without day-one false positives. Count → promote.

Virtual patching at the edge buys time before CMS updates land. Managed WAF rules start in count; promote what's safe to block — Copilot explains, you click.

Friday CMS CVE? Put an emergency virtual patch at the edge in count first, then promote what's safe while WordPress and Drupal teams patch. Copilot explains — you click.

A branded 403 is what visitors see after you promote a rule to block. Count mode comes first. Promote Copilot explains what's safe — you still click once.

Edge-managed WAF for WordPress — no security plugin. Cover campus departmental sites, plugin lag, and upload/form abuse with count → promote.

WordPress multisite WAF for campus networks — one edge for many blogs, plugin lag on subsites, shared origin risks. Count → promote; no plugin on every site.

Edge-managed WAF for Shopify — no security app. Cover custom and headless storefronts, marketing domains you control, and cart/checkout Ajax with count → promote.

Edge-managed WAF for Magento and Adobe Commerce — no security extension. Cover campus bookstores, StyleSmuggler-class zero-days, and payment paths with count → promote.

Edge-managed WAF for Drupal — no security module. Cover campus multi-site estates, contrib lag, and virtual patch XSS with count → promote.

Drupal multisite WAF for campus and agency estates — one edge for many sites, contrib lag, form POSTs. Count → promote; no security module on every site.

City website firewall for permits, benefits, and FOIA. How a managed WAF for government websites handles public sector WAF false positives and origin IP lock-down — count first, then promote.

Government website defacement protection — agency homepage hacked WAF, public sector website takeover prevention, city website defacement firewall. Edge shield, origin hide, count → promote.

FOIA portal WAF and public records request form security — count-first so citizens aren’t blocked; scrapers and queue floods stop at the edge.

Managed WAF for higher education — university website firewall, college website WAF, campus managed WAF. Count → promote; admissions forms stay up.

Managed WAF for multiple websites — campus website estate firewall, multi-site WAF one team, agency multi-domain WAF, Campus Estate WAF. Count → promote.

WAF for student portals without breaking SSO — count-first SIS, LMS, and IdP callbacks. Stop login stuffing; keep real students. Count → promote.

Canvas WAF, Moodle WAF, and LMS behind managed WAF — protect course sites from bots and probes without false positives on uploads, quiz POSTs, or LTI/SSO callbacks.

Athletics website WAF, university news site firewall, and campus microsite WAF — count → promote for tickets, donations, and game-day traffic without breaking forms.

A plain-English explanation of what a web application firewall (WAF) is, what it protects against, and how a managed WAF works.

A simple explanation of the OWASP Top 10 web application risks and how a web application firewall mitigates them.

What the important HTTP security headers do — HSTS, Content-Security-Policy, X-Frame-Options, and more — and why they matter.