WAF for campus LMS sites without breaking courses
When a web application firewall sits in front of a campus LMS, the first failure rarely looks like a blocked exploit. It looks like a quiz POST that 403s mid-attempt, a PDF upload that never lands, an LTI tool that never returns, or a scraper that empties courses while a blunt rate limit locks out dorm Wi‑Fi. This guide is for higher-ed web and LMS operators who need a Canvas WAF, Moodle WAF, or LMS behind managed WAF — including Blackboard-style course sites and learning management system WAF false positives — without a deny-first pack that breaks the term. Portal / SSO: /guides/student-portal-waf. SSO callbacks: /guides/waf-sso-false-positives. Estate: /guides/higher-education-managed-waf. Vertical: /waf-for/higher-education. ProtectMyWebsite starts rules in count. After about a day, the dashboard shows what is safe to promote — one click. Promote Copilot explains the recommendation. You still decide. You still click. We are not an official Canvas, Moodle, or Blackboard partner — we sit at the DNS edge in front of hostnames you already run.
Why LMS / course sites break under deny-first WAFs
Course platforms are authenticated, body-heavy apps: browser → SSO → LMS → quiz POST / upload / LTI → tool callback. Deny-on-day-one packs treat that chain like anonymous exploit noise.
Path-only rules miss the fight: the body, the upload, and the callback. Do not turn the WAF off — observe first, then promote only junk.
| LMS surface | Why a rule may match | What operators see |
|---|---|---|
| Quiz / assignment POSTs | Large bodies, nested JSON, timed retries | Mid-quiz 403; attempt lost |
| File / media uploads | Multipart, PDF/Office/video MIME, size bands | “Upload failed” at peak hours |
| LTI / tool launches | Signed POSTs, non-browser return agents | Tool opens; grade never syncs |
| SSO / IdP callbacks into LMS | Long SAML/OIDC assertions | Auth at IdP; LMS session never starts |
| Course content scraping | High GET rate on /courses/* | Content stolen; IP bans hit dorms |
Canvas WAF, Moodle WAF, and Blackboard-style campus sites
Putting a Canvas WAF, Moodle WAF, or Blackboard-style course hostname behind a managed edge is sound — probes hit the shield first — but deny-first packs punish live instruction. Mobile clients, rich editors, and LTI tools share shape with abuse until evidence says otherwise.
Start injection, XSS-class, upload, protocol, and bad-bot candidates in count on the LMS vhost.
Confirm failures are probe-shaped, not “every quiz save in business hours.”
Allowlist trusted upload bands and known LTI callbacks when Copilot flags Needs allowlist.
Promote noisy anonymous probes elsewhere — do not disable /api/* or course routes wholesale.
Same pattern for SaaS Canvas, self-hosted Moodle, or Blackboard-style stacks: you own the hostname; ProtectMyWebsite sits at DNS. We are not an official Canvas, Moodle, or Blackboard partner. Portal: /guides/student-portal-waf. SSO: /guides/waf-sso-false-positives.
File uploads and quiz POSTs — learning management system WAF false positives
Learning management system WAF false positives cluster where instructors notice first: uploads and timed assessments.
1. Keep multipart upload and quiz/assignment POST routes in count for ~24 hours of real class traffic — including Monday peaks and exam windows.
2. When Promote Copilot says Needs allowlist or Hold on known upload or quiz paths, do not promote blind.
3. Allowlist or narrow-scope legitimate content types and size bands; promote the same rule family on anonymous exploit paths.
4. Re-test: login → course → quiz submit → PDF upload after each promote.
Forms context: /guides/waf-false-positives-forms. A large student PDF is not a probe by default.
LTI / SSO callbacks and bot scraping of courses
LTI launches and LMS SSO returns carry long signed bodies and atypical User-Agents. “Browser only” rules can drop the return leg so the tool said yes and the gradebook said nothing. Keep LTI and callback routes in count; allowlist known ACS / redirect / tool-return paths when Copilot says Needs allowlist. Deeper SSO: /guides/waf-sso-false-positives.
Course scrapers are different: high-volume GETs across modules and files. Shared campus NAT means a blunt IP rate limit locks out a dorm floor while a proxy keeps scraping.
1. Rules start in count — including rate limits on course and file paths.
2. ~24 hours of real traffic — LTI callbacks and peak student hours show up.
3. Dashboard shows what’s safe to block — one click.
4. Promote Copilot recommends Promote, Hold, or Needs allowlist. It does not auto-block.
| Signal | Scraper / abuse | Real student traffic |
|---|---|---|
| Timing | Steady crawl or burst across many courses | Class change, assignment due windows |
| Paths | Module trees, file dumps, sequential IDs | Login → course → quiz/upload sequence |
| Bodies / ASN | Mostly GET; cloud/proxy ASNs | Quiz POSTs, uploads, LTI; campus/ISP |
How to put a WAF in front of campus LMS sites safely
1. Inventory the course chain — LMS hostname, SSO, quiz/upload routes, LTI returns — not just the marketing .edu.
2. Onboard at the edge — one DNS change (or concierge DNS). Hosting and LMS stay put.
3. Prefer count on LMS, upload, quiz, and callback routes — after ~24 hours the dashboard shows what is safe to block.
4. Read the recommendation — Copilot explains Promote / Hold / Needs allowlist; humans click.
5. Allowlist or scope LTI returns, SSO callbacks, and trusted upload bands before gutting inspection.
6. Re-test IdP → LMS → quiz → upload → LTI after each promote.
7. Watch multi-site estates as a set — a rule safe on the brochure site may need Hold on the LMS.
Pricing
Pricing (self-serve): $150/site/month, 14-day trial. Multi-site / Campus Estate: Talk to sales — no Estate dollar amounts here.
FAQ
What is a Canvas WAF or Moodle WAF? An edge WAF in front of Canvas, Moodle, Blackboard-style, or other LMS hostnames so probes and scrapers hit the shield first. ProtectMyWebsite is DNS-managed; LMS and IdP stay put. Rules start in count; you promote what’s safe. Not an official Canvas or Moodle partner. Vertical: /waf-for/higher-education.
Why do LMS sites get learning management system WAF false positives? Quiz POSTs, uploads, LTI launches, and SSO callbacks carry large or opaque bodies that blunt rules treat as abuse. Keep those routes in count; allowlist known paths when Copilot says Needs allowlist. Forms: /guides/waf-false-positives-forms.
Can I put an LMS behind managed WAF without breaking classes? Yes — if you observe first. Large POSTs, uploads, mobile clients, and LTI tools share shape with abuse. Count on the LMS vhost, promote probe-shaped hits, allowlist trusted upload/LTI routes when evidence says so. Companion: /guides/student-portal-waf. Estate: /guides/higher-education-managed-waf.
How do you stop course scrapers without locking out dorm Wi‑Fi? Scrapers crawl module and file trees with little POST follow-through, often from cloud or proxy ASNs. Real students cluster at class-change and due windows and complete quiz/upload/LTI sequences. Count evidence plus rate-limit candidates (promote only what’s safe) beats a day-one IP ban on shared campus NAT.
Does Promote Copilot auto-block LMS traffic? No. Copilot explains Promote / Hold / Needs allowlist from count-window evidence. The human still clicks. If AI is unavailable, the non-AI suggest UI remains.
Start here
ProtectMyWebsite is the managed WAF for higher-ed web and LMS teams who need a Canvas WAF, Moodle WAF, or LMS behind managed WAF that watches uploads, quizzes, LTI, and scrapers first — without false positives that break the semester.
Pricing (self-serve): $150/site/month, 14-day trial. Campus estate (many LMS hostnames): Talk to sales — no Estate dollar amounts here.