WAF for student portals without breaking SSO

Campus portals — SIS, LMS, SSO/IdP, and registration — break under deny-first packs. A student who cannot finish login or add/drop is an outage the campus feels. ProtectMyWebsite is a managed edge WAF: rules start in count, you allowlist IdP and LMS callbacks, then promote what the dashboard shows is safe. Promote Copilot explains Promote, Hold, or Needs allowlist. It does not auto-block. You still click. Short product page: /waf-for/higher-education. Campus operator cut: /guides/higher-education-managed-waf. This guide stays on student portals — stuffing vs real students — not a deny pack before registration week.

Why deny-first breaks campus portals

Deny-first managed packs treat campus portals like a brochure site. They are not. SIS, LMS, SSO, registration, and partner callbacks share the same VIP and the same odd-looking POSTs that signature packs were written to catch.

A blocked SSO callback is not a quiet security event. It is a closed counter: students cannot reach the LMS, the registrar, or financial aid. Count-first plus an allowlist is the operator-safe path.

Campus deep dive: /guides/higher-education-managed-waf. Vertical: /waf-for/higher-education.

Deny-first vs count-first on campus portal surfaces
Surface	What deny-first breaks	Count-first + allowlist
SSO / IdP	SAML, OIDC, CAS, or Shibboleth callbacks never return	Needs allowlist on the callback path; promote probes elsewhere
LMS	Grade passback, LTI, and session cookies look like injection	Count on LMS routes; allowlist known callbacks
SIS	Registration POSTs and student IDs trip SQLi signatures	Observe peak add/drop; promote junk only
Login	Peak-hour students share a rate with stuffing scripts	Count, then promote high-rate stuffing — not the login path itself
Partner	Payment, housing, or transcript vendors use atypical User-Agents	Needs allowlist on partner callbacks

Managed WAF for university and college websites Managed WAF for higher education websites

University SSO and IdP callbacks need an allowlist

University SSO is a routing problem as much as a WAF problem. The public hostname sends the browser to the IdP; the IdP POSTs back with tokens, RelayState, and atypical User-Agents. Signature packs read those as unsigned-looking payloads.

Promote Copilot will often say Needs allowlist on /cas, /saml, /oidc, /oauth, and Shibboleth callback paths until the count window is clean. That is the correct recommendation — not a day-one deny.

Copilot does not write the allowlist. You add an Allow match for the observed IdP callback, then re-check the count window. Promote probes on other paths. You still click once.

Observe foundation: /guides/waf-count-mode. Promote language: /guides/whats-safe-to-block.

What is WAF count mode? (and why you start there)What's safe to block on a WAF?

LMS behind a WAF — keep class up

An LMS behind a WAF still has to accept long POSTs, file uploads, LTI launches, and grade-passback from the SIS. Those bodies look like the same abuse the pack was written to stop.

Path-only rules miss the fight — the body. Block-first makes the first casualty a quiz submit or a transcript upload. Keep LMS and registration endpoints in count until evidence says promote.

Forms and uploads deep dive: /guides/waf-false-positives-forms.

WAF false positives on forms: stop blocking legitimate POSTs

Managed student login stuffing vs real students

Credential stuffing and real students share a login path. The job is not to deny /login on day one. It is to observe, then promote the stuffing pattern — rate, session shape, and source — while peak-hour students keep working.

Bot and rate-limit deep dive: /guides/waf-bot-management. Count-first: (1) rules start in count (2) ~24 hours real traffic (3) dashboard shows what’s safe — one click (4) Promote Copilot recommends Promote/Hold/Needs allowlist — does not auto-block.

Login stuffing vs real students — signals operators actually use
Signal	Credential stuffing	Real students
Rate	Hundreds of password attempts from rotating IPs	Bursts at the top of the hour, then human pacing
Session	Login only — no LMS click, no registration POST	SSO → LMS or SIS in the same session
IdP callback	Rare or missing — stuffing hits the portal form directly	SAML/OIDC/CAS callback completes
User-Agent	Scripted, outdated, or identical across many IPs	Campus browsers, mobile, accessibility tools
Calendar	Steady 24/7 from new ranges	Add/drop, orientation, and Monday mornings

WAF bot management for campus and agency sites

Safe onboard — seven steps

1. Inventory the portal hostnames: SIS, LMS, SSO/IdP, registration, and partner callbacks that share the VIP.

2. Point public DNS at the edge — or request concierge DNS. Hosting and the CMS stay put.

3. Rules start in count. Matches log; they do not deny yet.

4. Allowlist IdP, LMS, and partner callback paths when Copilot says Needs allowlist. Copilot does not write the allowlist.

5. Run ~24 hours of real student traffic — including a peak login or add/drop window if you can.

6. The dashboard shows what’s safe to block — one click. Promote Copilot explains Promote, Hold, or Needs allowlist.

7. You still click once. Promote stuffing and probes. Keep mixed student POSTs in count until the window is clean.

Pricing

Pricing (self-serve): $150/site/month, 14-day trial at checkout — see pricing. For larger campus estates (main site + many departmental portals), Talk to sales — volume for larger estates; no Estate dollar amounts here.

See pricing Talk to sales team

FAQ

Why does deny-first break student portals? SIS, LMS, SSO, login, and partner callbacks share odd-looking POSTs with the abuse the packs were written to catch. A blocked IdP callback or registration POST is a closed counter. Count first; allowlist real callbacks; promote junk.

Do university SSO and IdP callbacks need an allowlist? Yes — Needs allowlist. SAML, OIDC, CAS, and Shibboleth callbacks use tokens and atypical User-Agents. Allowlist the observed callback path. Promote probes elsewhere. Copilot does not write the allowlist.

How do you put an LMS behind a WAF without breaking class? Keep LMS, LTI, and grade-passback routes in count. Body-aware rules start in observe. After ~24 hours, promote only what the dashboard shows is safe. See WAF false positives on forms.

How do you tell login stuffing from real students? Stuffing is high-rate, login-only, often missing the IdP callback. Real students complete SSO and continue into the LMS or SIS, especially at peak hours. Count, then promote the stuffing pattern — not the login path itself. See WAF bot management.

Does Promote Copilot auto-block? No — The human still clicks. Copilot explains Promote, Hold, or Needs allowlist from count-window evidence. It does not auto-block.

Start here

ProtectMyWebsite is the managed WAF for student portals that have to stay up — SIS, LMS, SSO, and registration — without a deny-first pack.

Pricing (self-serve): $150/site/month, 14-day trial. Larger campus estates: Talk to sales — no Estate dollar amounts here.

Free security scan Start a 14-day trial Pricing Higher education Managed WAF for higher education Talk to sales team

Scan a student portal — then start in count

Start a 14-day trial Scan your site — free Pricing