WAF and DDoS protection

A WAF inspects each HTTP request before it reaches your server and blocks those that match known attack patterns: SQL injection and XSS attempts, probes for known vulnerable plugins, bad bots and abusive request rates. Rules come as managed rulesets kept up to date by the vendor (several are based on the open-source OWASP Core Rule Set) plus custom rules you write, such as closing the admin area to other countries or limiting login attempts per minute.

A distributed denial-of-service (DDoS) attack sends more traffic than a server or network can handle, from thousands of machines at once. Protection works at the network layer (floods of packets) and at the application layer (floods of real-looking HTTP requests), and relies on a provider with enough capacity, spread across many data centres, to absorb the flood. Cloudflare includes unmetered DDoS protection on every plan, the free one included, and AWS Shield Standard is automatic for AWS customers.

Other options include AWS WAF, Google Cloud Armor, Azure WAF, Akamai and Fastly, plus the open-source ModSecurity and Coraza engines. AWS WAF charges about $5 a month per web ACL (a set of rules), $1 a month per rule and $0.60 per million requests; AWS Shield Advanced costs about $3,000 a month on a one-year commitment. A WAF buys time but does not fix the bug underneath, and the origin server should accept traffic only from the WAF so that nobody can go around it.