Managed WAF for Drupal Multisite campus estates
Campus and agency web teams do not lose sleep over one polished main Drupal site. They lose sleep over a Drupal Multisite (or shared-codebase) estate — colleges, labs, alumni portals, agency microsites under one codebase: shared core, shared contrib, shared origin. ProtectMyWebsite is a Drupal multisite WAF and campus Drupal multi-site firewall: one DNS change in front of the estate hostnames (or we handle DNS), rules at the edge, Multisite and editors unchanged. Short product page: /waf-for/drupal. Single-site deep dive: Managed WAF for Drupal without a module. This guide goes narrower — why a Drupal estate managed WAF no module beats per-site security packs, how contrib lag threatens the shared stack, and how count → promote scales across the estate.
Why Drupal Multisite is a different operator problem
Standalone departmental Drupal is hard. Multisite and shared-codebase estates are harder for structural reasons:
One edge covers many sites. Domain or subdomain sites share one public origin story. A shield in front of the estate protects the catalog — not a separate security module per site.
Contrib lag is estate-wide risk. A vulnerable Webform, media, or menu module on one lab or agency microsite still sits on the same origin as admissions and college sites. Edge virtual-patch buys time while estate owners schedule Composer updates.
Shared origin, shared blast radius. Login floods, Form API abuse, and contrib exploit probes hit one PHP stack. Junk on a forgotten event site still burns CPU and can open paths that matter elsewhere.
Editors are not estate operators. Faculty and agency staff paste HTML, upload PDFs, and save Layout Builder drafts on their own sites. A deny pack that breaks one Webform on one college site is still a central IT ticket.
Same campus and agency problem — many sites, one thin team — with Multisite’s twist: one codebase, many sites, one origin. See higher education, government, and multi-site campus and agency estates. Athletics, news, and departmental microsites on the same catalog: WAF for athletics, news, and campus microsites. WordPress Multisite is the sister shared-codebase cut.
Edge WAF vs security modules on every site
A Drupal security module on Multisite runs inside the application — often shared across sites, sometimes inconsistently per site. The request has already reached PHP and the same process that serves every site. That can help with hardening. It is not stopping exploit noise before the shared origin.
An edge-managed Drupal multisite WAF sits in front: (1) Login floods, Form API abuse, and known contrib exploit probes hit the shield first — once for the whole estate. (2) Origin sees less junk CPU across every site, not just the ones that finished a Composer update. (3) No security module to conflict with custom themes, Layout Builder, or a vendor-managed train. (4) No extra PHP hooks on every anonymous hit or Webform POST across dozens of sites.
The pitch is not “delete every hardening module forever.” It is: stop treating an in-app module as your edge for a Multisite estate. Managed path: DNS → observe → promote — not another Composer package per site.
Contrib lag, form POSTs, and estate blast radius
Attackers prefer multipart and POST bodies, not pretty exploit URLs. On Drupal Multisite, Webform uploads, Form API fields, and media chains look fine in the path and only show up when the WAF inspects the body — and a hit on one site still lands on the shared origin.
What that means for a campus Drupal multi-site firewall: Path-only rules are not enough. Match Form API fields, uploads, and XSS-class payloads in the body. Count before block — across the estate. A rule that fires on legitimate PDFs, Layout Builder saves, or admissions Webforms is a ticket storm. Start in count; promote when hits look like junk. Login and IdP floods still matter — rate limits blunt them at the edge for every site. Emergency virtual-patch when shared contrib is late: edge first, then Composer.
Forms that must keep working: admissions, FOIA and benefits intake, event RSVPs, donations, ticket uploads. Block-first makes those the first casualties.
Count → promote across a Drupal Multisite estate
Count-first is the operator-safe path for a Drupal estate managed WAF no module:
1. Rules start in count. Matches log; they do not deny yet — same story for every site behind the estate hostnames.
2. Real traffic runs ~24 hours. Estate admins, site editors, monitors, IdP callbacks, and peak form hours show up across the catalog.
3. The dashboard shows what’s safe to block — one click.
4. Promote Copilot recommends Promote, Hold, or Needs allowlist — evidence plus a short why. It does not auto-block. You still click.
Shared count → promote is how one operator scales a Multisite edge without a different deny story per site.
How ProtectMyWebsite runs Drupal Multisite protection
Pricing (self-serve): $150/site/month, 14-day trial at checkout. For larger Multisite or campus/agency estates, Talk to sales — volume for larger estates; no Estate dollar amounts here.
Keep Multisite origin IPs off the public internet so a flood or exploit probe cannot walk around the edge. DNS cutover to count: Managed WAF setup.
| Step | What happens |
|---|---|
| Onboard | One DNS change for estate hostnames (or concierge DNS, ~one business day). Multisite, themes, and hosting stay put — no security module required. |
| Observe | Managed rules for injection, XSS-class noise, known Drupal/contrib exploit patterns, bad bots, malicious IPs, plus rate limits useful on /user/login — all start in count. |
| Promote | After ~24 hours, the dashboard surfaces candidates. Copilot explains Promote / Hold / Needs allowlist; the human promotes. |
| Operate | No Drupal module to keep updated on every site. Edge shield stays on while estate owners finish Composer updates and cache clears. |
FAQ
What is a Drupal multisite WAF without a module? An edge web application firewall in front of your Drupal Multisite (or shared-codebase) estate hostnames that you do not install as a Drupal module on every site. ProtectMyWebsite sits on DNS; Drupal Multisite, themes, and hosting stay as they are. Rules start in count; you promote what’s safe to block.
Why not enable a Drupal security module on every Multisite site instead? Modules help inside the app. They do not stop traffic before the shared origin, they add PHP overhead on every site, and estate-wide enablement still leaves you patching inside Drupal. Edge WAF and in-app hardening solve different layers — for Multisite teams, the edge is the gap.
How do you protect a campus Drupal multi-site estate when contrib lags? Put the shield up in count, virtual-patch known exploit patterns at the edge, watch Form API and Webform endpoints across the estate, then promote rules that fire on junk. That buys time while owners ship the real Composer update — without flipping deny on day one. See Emergency virtual patch.
Will a managed WAF break Multisite Webforms or Layout Builder? It can, if you block-first. ProtectMyWebsite starts rules in count, surfaces promote candidates after ~24 hours, and Promote Copilot flags Hold or Needs allowlist when hits look like editors or legitimate POSTs. You promote when evidence says it is safe.
Does Promote Copilot auto-block Drupal Multisite traffic? No. Copilot explains Promote / Hold / Needs allowlist from count-window evidence. The human still clicks. If AI is unavailable, the non-AI suggest UI remains.
Start here
ProtectMyWebsite is the managed WAF for Drupal Multisite operators who need one edge for many sites — without a security module on every property.
Pricing (self-serve): $150/site/month, 14-day trial. Campus / Multisite estate (many sites): Talk to sales — volume for larger estates; Copilot included on self-serve and estate paths. No Estate dollar amounts here.
Related
- All guides
- A managed WAF for your Drupal site
- Managed WAF for Drupal without a module
- Managed WAF for higher education websites
- Managed WAF for government websites
- Managed WAF for multi-site campus and agency estates
- WAF for athletics, news, and campus microsites
- Managed WAF for WordPress Multisite campus networks
- Managed WAF setup: DNS cutover to count mode
- Emergency virtual patching when a CMS CVE drops
- Free security scan
- Start a 14-day trial
- Pricing