Managed WAF for WordPress without a plugin

Edge WAF vs WordPress security plugins

A security plugin runs inside WordPress. The request has already reached PHP, loaded the theme, and often touched the database. Login floods, XML-RPC hammering, and known-plugin probes consume origin CPU first. The plugin then tries to reject what already landed.

An edge-managed WAF sits in front: (1) login floods, XML-RPC, and exploit probes hit the shield first (2) the origin sees less junk (3) no plugin conflicts with builders, caching, or themes (4) no extra PHP hooks. You do not drop a must-use plugin so "security loads first."

Pitch: stop treating a PHP plugin as your edge. A plugin can still help with malware scans, file integrity, and admin hygiene. It cannot be the first filter for traffic you never wanted on the box. Managed path: DNS → observe → promote.

Why departmental campus WordPress is the hard case

Campus WordPress is rarely one Multisite. It is dozens of installs with uneven patch discipline: nursing, athletics, alumni, research labs, continuing-ed. Mixed hosts, mixed themes, mixed plugin lists. Central IT did not choose most of them. Nobody fully owns the orphan — the chair thinks communications owns it, communications thinks IT owns it, and IT has the DNS zone plus a spreadsheet of sites they think exist.

Plugin lag is structural. The person who can click Update is on leave, or they last logged in during orientation. When a plugin CVE drops, the owned properties get patched. The orphans stay on last year's stack. An edge virtual-patch buys time while the ticket to update works through the department.

Editors are not WAF operators. Student workers rotate every semester. They can install a form plugin. They cannot run a firewall. Deny-on-day-one punishes faculty and student workers who need wp-admin and the media library. A block-first rule that locks the newsroom is a ticket storm.

Auth and SSO are shared. wp-login.php, XML-RPC, and IdP callbacks look noisy. Inventory is incomplete — forgotten event, FOIA, and continuing-ed forms still accept POSTs long after the owner left.

That is the same operator problem as /waf-for/higher-education: many sites, a thin team, and no appetite for false positives on admissions or citizen forms.

Plugin lag, RCEs, and body-matched abuse

Plugin lag is the gap between a disclosed WordPress core or plugin CVE and the day that specific install is patched. Attackers do not wait. They scan wp-login.php, xmlrpc.php, and known plugin paths the same week the advisory lands.

They prefer multipart and POST bodies, not pretty URLs. Imagick and Ghostscript media RCEs and Elementor-style upload chains ride file fields. A path-only filter never fires when the exploit is in the body.

An edge WAF does not patch PHP. It does buy time if the rule sees the semantic exploit and you ran count before you promote. Rate-limit login and XML-RPC at the edge so floods never reach PHP.

Read /guides/waf-count-mode and /guides/whats-safe-to-block for the operator versions of observe, then one-click promote.

Upload and form abuse on campus and agency sites

Campus and agency WordPress abuse is often not a clever zero-day on core. It is an upload or a forgotten form: event registration, FOIA, donations, tickets, continuing-ed.

Abuse looks like credential stuffing on wp-login, scripted form POSTs, malicious uploads, and probe strings in registration bodies. Author-level media that Imagick treats as PostScript-family content. Elementor-class file-upload chains. A departmental "submit your poster" form that never got a size limit.

Count-first is how you tighten without breaking the media library or a public form: (1) rules start in count (2) real traffic runs about 24 hours (3) the dashboard shows what's safe to block — one click (4) Promote Copilot names Promote, Hold, or Needs allowlist. It does not flip a rule to block on its own.

Promote: hits look like junk or abuse. Hold: the window is mixed or sparse. Needs allowlist: legitimate traffic is matching — add an Allow match for the observed path or method in Custom rules first. Copilot does not write the allowlist. Re-check the count window before you promote.

Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click. After you do promote, blocked visitors see a branded 403 with a reference they can send you — /guides/branded-waf-403.

How ProtectMyWebsite runs WordPress protection

How it runs, as a table you can hand a campus web lead:

Onboard: DNS — one change, or we handle it. Hosting and editors stay put.

Observe: rules start in count, including wp-login and XML-RPC. Nothing is blocked on day one.

Promote: Promote Copilot plus a human. Promote Copilot reads your count window and explains what's safe to promote — you still click once.

Operate: no WordPress plugin. No mu-plugin. We run the shield.

Self-serve is $150/site/mo with a 14-day trial. Cancel before day 14 and you will not be charged. Campus Estate is quote on request — Talk to sales team. We do not publish Estate list prices.

Keep origin IPs off the public internet so a flood cannot walk around the edge. That story is in /blog/request-flood-origin-bypass.

FAQ

What is a managed WAF for WordPress without a plugin? A shield in front of the site via DNS. Rules run at the edge. Hosting, themes, and editors stay where they are. No security plugin required to be the first filter.

Why not just a WordPress security plugin? A plugin runs inside PHP after the request has already arrived. Login floods, XML-RPC, and upload probes consume the origin first. An edge WAF stops that junk before it touches WordPress.

How do you protect departmental sites that lag on patches? Edge virtual-patch buys time while the update ticket works through the department. Count first so you do not lock editors while you wait.

Will it break forms or the media library? Not on day one. Rules start in count. Promote Copilot explains Promote, Hold, or Needs allowlist. You still click once.

Does Promote Copilot flip rules to block on its own? No. It explains. You still click once. Copilot does not write the allowlist.

Start here

Self-serve is $150/site/mo with a 14-day trial. Campus Estate is quote on request — Talk to sales team. We do not publish Estate list prices.

Related

• All guides
• A managed WAF for your WordPress site
• Managed WAF for university and college websites
• What is WAF count mode? (and why you start there)
• What's safe to block on a WAF?
• What a WAF 403 page means (and why you start in count)
• Free security scan
• Start a 14-day trial
• Pricing
• Solutions & guides
• A client was taking 90 million requests an hour. The WAF was only half the fight.