A shield in front of public sites. We run it.
Agency and public sites have to stay up — permit forms, benefits applications, notices. We put a managed web application firewall in front, watch, then block. Same product, same trial.
Public forms that can't go down
A blocked permit or benefits form is an outage the public notices. Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
Promote Copilot is included — you still click once. Nothing is blocked on day one — a false positive is not an overnight outage.
FOIA and public-records portals — uploads, long narratives, scrapers, and queue floods — are the same count-first problem. Operator cut: /guides/foia-public-records-waf.
Operator deep-dive on scrapers, form spam, and credential stuffing: WAF bot management for campus and agency sites.
If the event is availability — a flood on the VIP, not a false-positive ticket — start with the first-hour playbook.
Friday CMS CVE week: same emergency virtual-patch runbook — count first, then promote while agency CMS teams patch.
Agency payment form security — permit fees, license renewals, citation payments — needs the same count-first money-path: WAF for donation and payment forms without blocking gifts.
Drupal and WordPress estates
Public-sector sites are often Drupal or WordPress — sometimes dozens of them. We sit in front via DNS. No module, no plugin, hosting stays put.
One shield per site. We run it.
Operator deep dive on inventory, shared count → promote, and self-serve vs Talk to sales: Managed WAF for multi-site campus and agency estates.
Same product, same trial
$150/site/mo, 14-day trial. We put the shield up, watch, then block — the same way we do for every other site.
Experience protecting higher-education and public-sector sites.
For the longer operator cut — city website firewall, public sector WAF false positives, and origin lock-down — read Managed WAF for government websites.
Homepage defacement and takeover is a public-trust problem, not just an IT ticket. Operator checklist: Stop Agency Website Defacement with a Managed Edge WAF.
Related
- Managed WAF for government websites
- Stop Agency Website Defacement with a Managed Edge WAF
- WAF for FOIA and public records portals
- A managed WAF for your Drupal site
- Managed WAF for university and college websites
- A managed WAF for your WordPress site
- What is WAF count mode? (and why you start there)
- What's safe to block on a WAF?
- Free Website Security Scan: What the Grade Means
- WAF false positives on forms: stop blocking legitimate POSTs
- WAF for donation and payment forms without blocking gifts
- WAF bot management for campus and agency sites
- Emergency virtual patching when a CMS CVE drops
- Hide your origin IP behind a WAF (and allowlist edge IPs only)
- Campus DDoS response: keep .edu sites up under flood
- DIY WAF vs managed: console burden or operator?
- Managed WAF pricing: is $150/site worth it?
- Managed WAF for multi-site campus and agency estates
- Concierge DNS: we point your site at the managed WAF
- Managed WAF for multi-site teams
- Pricing
- Free security scan
- A client was taking 90 million requests an hour. The WAF was only half the fight.
- WAF Watch: Events Calendar RCE, Elementor uploads, Drupal table field
- WAF Watch: WooCommerce webshells, Drupal CKEditor, campus SAML