ProtectMyWebsite
Menu

Solutions & guides

How ProtectMyWebsite compares, how it protects popular platforms, public-sector, and multi-site teams, and plain-English web security guides. Agency web shops can hand off the WAF and stay the web partner.

Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click. Promote Copilot reads your count window and explains what's safe to promote — you still click once. $150/site/mo, 14-day trial — or Campus Estate for campus teams.

Compare

ProtectMyWebsite vs Cloudflare
Cloudflare gives you a dashboard. ProtectMyWebsite gives you a managed AWS WAF, set up and tuned for you. Compare the two for website protection.
ProtectMyWebsite vs Sucuri
Comparing Sucuri's website firewall with ProtectMyWebsite's fully managed AWS WAF — coverage, edge network, and pricing.
ProtectMyWebsite vs the raw AWS WAF console
AWS WAF is powerful but complex to set up and run yourself. ProtectMyWebsite is that same AWS WAF, provisioned and managed for you.

WAF by platform

A managed WAF for your WordPress site
WordPress is the most-attacked CMS on the web. Put a fully managed WAF in front of your WordPress site — no plugin, one DNS change.
A managed WAF for Shopify storefronts
Protect your Shopify-powered storefront or custom checkout with a managed AWS WAF — bot defense, rate limiting, and account-fraud protection.
A managed WAF for Magento & Adobe Commerce
Magento stores are high-value targets. Put a fully managed AWS WAF in front of your Magento or Adobe Commerce site — OWASP, bots, and rate limiting.
A managed WAF for your Drupal site
Edge protection for Drupal without a module. We run the firewall so /user and public forms stay up. $150/site/mo, 14-day trial.

WAF by vertical

A shield in front of campus sites. We run it.
Campus Estate for higher-ed / multi-site campus teams — quote on request. Single sites stay on $150/site/mo, 14-day trial. We run the shield.
A shield in front of public sites. We run it.
A managed web application firewall for agency and public sites. We put the shield up, watch, then block. $150/site/mo, 14-day trial.

Multi-site teams

Managed WAF for multi-site teams
Fully managed WAF for campus and agency teams running many sites — count mode first, ~1 day onboard, $150/site/mo, 14-day trial.
Estate Brain is coming
Estate Brain will roll risk across campus sites. It is not live. Promote Copilot is live today — you still click once.

Agency partners

Partner with ProtectMyWebsite
For Drupal shops and campus/agency web agencies — you keep the build, we run the managed WAF. $150/site/mo, 14-day trial, count→block dashboard.

Security guides

What is a WAF (Web Application Firewall)?
A plain-English explanation of what a web application firewall (WAF) is, what it protects against, and how a managed WAF works.
The OWASP Top 10, explained simply
A simple explanation of the OWASP Top 10 web application risks and how a web application firewall mitigates them.
HTTP security headers, explained
What the important HTTP security headers do — HSTS, Content-Security-Policy, X-Frame-Options, and more — and why they matter.
What is WAF count mode? (and why you start there)
Count mode lets campus and agency teams put a WAF in front of production without blocking real users on day one — observe ~24 hours, then promote what's safe to block.
What a WAF 403 page means (and why you start in count)
A branded 403 is what visitors see after you promote a rule to block. Count mode comes first. Promote Copilot explains what's safe — you still click once.
What's safe to block on a WAF?
Learn what's safe to block on a managed WAF. Rules start in count; Promote Copilot explains Promote, Hold, or Needs allowlist — you still click once.
What is Promote Copilot?
Promote Copilot is the AI layer on ProtectMyWebsite count mode: Promote, Hold, or Needs allowlist in plain English — you still click. Not an auto-block LLM firewall.
WAF false positives on forms: stop blocking legitimate POSTs
Why WAFs block registration, admissions, and government forms — multipart uploads, CSRF tokens, odd field names, payment callbacks — and how count-first stopping of false positives works.
WAF for donation and payment forms without blocking gifts
Donation form WAF false positives, university payment portal firewall, and giving day website WAF — count-first so payment callbacks and alumni gifts don’t break; bot stuffing on donate endpoints.
Managed WAF for WordPress without a plugin
Edge-managed WAF for WordPress — no security plugin. Cover campus departmental sites, plugin lag, and upload/form abuse with count → promote.
Managed WAF for WordPress Multisite campus networks
WordPress multisite WAF for campus networks — one edge for many blogs, plugin lag on subsites, shared origin risks. Count → promote; no plugin on every site.
Managed WAF for Shopify without app spam
Edge-managed WAF for Shopify — no security app. Cover custom and headless storefronts, marketing domains you control, and cart/checkout Ajax with count → promote.
Managed WAF for Magento without an extension
Edge-managed WAF for Magento and Adobe Commerce — no security extension. Cover campus bookstores, StyleSmuggler-class zero-days, and payment paths with count → promote.
Managed WAF for Drupal without a module
Edge-managed WAF for Drupal — no security module. Cover campus multi-site estates, contrib lag, and virtual patch XSS with count → promote.
Managed WAF for Drupal Multisite campus estates
Drupal multisite WAF for campus and agency estates — one edge for many sites, contrib lag, form POSTs. Count → promote; no security module on every site.
Managed WAF for government websites
City website firewall for permits, benefits, and FOIA. How a managed WAF for government websites handles public sector WAF false positives and origin IP lock-down — count first, then promote.
WAF for FOIA and Public Records Portals
FOIA portal WAF and public records request form security — count-first so citizens aren’t blocked; scrapers and queue floods stop at the edge.
Stop Agency Website Defacement with a Managed Edge WAF
Government website defacement protection — agency homepage hacked WAF, public sector website takeover prevention, city website defacement firewall. Edge shield, origin hide, count → promote.
WAF bot management for campus and agency sites
WAF bot management for campuses and agencies — stop scrapers, admissions form spam, and credential stuffing without day-one false positives. Count → promote.
WAF for student portals without breaking SSO
WAF for student portals without breaking SSO — count-first SIS, LMS, and IdP callbacks. Stop login stuffing; keep real students. Count → promote.
WAF SSO false positives: keep campus logins working
WAF SSO false positives, IdP callbacks blocked by WAF, and SAML CAS OIDC allowlists — count first so Monday login storms don’t brick university and agency SSO.
WAF for campus LMS sites without breaking courses
Canvas WAF, Moodle WAF, and LMS behind managed WAF — protect course sites from bots and probes without false positives on uploads, quiz POSTs, or LTI/SSO callbacks.
WAF for athletics, news, and campus microsites
Athletics website WAF, university news site firewall, and campus microsite WAF — count → promote for tickets, donations, and game-day traffic without breaking forms.
Managed WAF for higher education websites
Managed WAF for higher education — university website firewall, college website WAF, campus managed WAF. Count → promote; admissions forms stay up.
Virtual patching websites with a managed WAF
Virtual patching at the edge buys time before CMS updates land. Managed WAF rules start in count; promote what's safe to block — Copilot explains, you click.
Emergency virtual patching when a CMS CVE drops
Friday CMS CVE? Put an emergency virtual patch at the edge in count first, then promote what's safe while WordPress and Drupal teams patch. Copilot explains — you click.
Hide your origin IP behind a WAF (and allowlist edge IPs only)
Origin IP bypass DDoS walks around your edge. Hide the origin IP behind a WAF and allowlist edge IPs only — the durable fix for campus and agency sites.
Campus DDoS response: keep .edu sites up under flood
Campus DDoS response for .edu and agency sites — first-hour playbook, origin IP lock-down, count→promote during recovery, and status/comms when the flood hits.
DIY WAF vs managed: console burden or operator?
DIY WAF vs managed for campus and agency teams. When console burden wins — and when managed WAF pricing is worth it vs running your own.
Managed WAF for multi-site campus and agency estates
Managed WAF for multiple websites — campus website estate firewall, multi-site WAF one team, agency multi-domain WAF, Campus Estate WAF. Count → promote.
Managed WAF setup: DNS cutover to count mode
Managed WAF setup for campus and agency teams: what one DNS change means, CNAME vs apex, SSL, count mode day 0–24, and how long go-live actually takes.
Managed WAF pricing: is $150/site worth it?
Honest managed WAF pricing guide: what $150/site/month includes, DIY people-cost vs fully managed WAF $150, and when campus teams should Talk to sales.
Free website security scan: what the grade means
Free website security scan with no signup: what the WAF scan report grade checks, how to read an F, and the Protect {domain} path to a 14-day trial.
Refer a Friend: 10% Off Managed WAF for Both of You
ProtectMyWebsite refer-a-friend: both sides get 10% off managed WAF for 3 months when your friend completes Checkout. Find your link, share your code, start a trial.
Concierge DNS: We Point Your Site at the Managed WAF
Concierge DNS WAF setup for campus and agency teams who won’t touch DNS — we coordinate cutover (~one business day), CNAME vs nameserver, SSL handled, then count → promote.

Blog