A shield in front of campus sites. We run it.
Too many departmental sites, a small central IT team, and forms that cannot go down. We put a managed web application firewall in front of student portals, departmental CMS, and admissions. We run it.
Campus Estate for the whole campus
Campus Estate is for higher-ed / multi-site campus teams. Quote on request — Talk to sales team. We do not publish Estate list prices.
Included: concierge DNS, named support (Mac / support@wafcybersecurity.com), quarterly threat/tuning review, priority virtual-patch / count→promote, and the Advisor.
A single departmental site or a small shop stays on $150/site/mo with a 14-day trial — we do not force every .edu through Estate. Self-serve also includes the Advisor.
An estate, not one homepage
Campus sites multiply — schools, athletics, news, research, and department CMS installs, often WordPress and Drupal together. Central IT cannot staff another console for each one.
Athletics, university news, and departmental microsites are the narrower operator cut — tickets, donations, and game-day traffic. See WAF for athletics, news, and campus microsites.
Add a site, point DNS, see what's watched and what's blocked. Same shield on every property.
When a flood hits the shared VIP, use the first-hour playbook — confirm edge vs origin before anyone panic-promotes.
Operator deep dive on inventory, shared count → promote, and self-serve vs Talk to sales: Managed WAF for multi-site campus and agency estates.
Estate Brain
WAF Cybersecurity Advisor stays per site — you still click once.
Estate Brain is a read-only rollup across the campus: which sites need a human, which attack classes hit more than one site, and which virtual patch groups are still off. It does not block on its own.
Don't take down registration or financial aid
A false positive on a registration or financial-aid form is an outage students feel. Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
The Advisor is included — you still click once. You keep the site; we run the shield.
Operator deep-dive on scrapers, admissions bot protection, and credential stuffing: WAF bot management for campus and agency sites.
Friday CMS CVE week: emergency virtual patch in count first, then promote while departmental WordPress and Drupal catch up.
Student portals (SIS, LMS, SSO, registration) need the same count-first path — deny-first breaks login. See WAF for student portals without breaking SSO.
Canvas, Moodle, and Blackboard-style course sites need the same count-first path for quiz POSTs, uploads, and LTI — see WAF for campus LMS sites without breaking courses.
Giving-day gifts, alumni donate, athletics boosters, and bursar/fee portals are a money-path false-positive problem — see WAF for donation and payment forms without blocking gifts.
Guided DNS — or we do DNS
Subdomains: the records we show, usually a CNAME plus certificate validation. Apex: an alias, a www redirect, or nameserver delegation. Or request concierge setup and we do DNS. Hosting and the CMS stay where they are.
$150/site/mo, 14-day trial for a single-site experiment. Experience protecting higher-education and public-sector sites.
For the longer operator cut — university website firewall, college website WAF, and campus managed WAF — read Managed WAF for higher education websites.
Related
- Managed WAF for higher education websites
- A managed WAF for your WordPress site
- A managed WAF for your Drupal site
- Managed WAF for government and public-sector websites
- What is WAF count mode? (and why you start there)
- What's safe to block on a WAF?
- Free Website Security Scan: What the Grade Means
- WAF false positives on forms: stop blocking legitimate POSTs
- WAF for donation and payment forms without blocking gifts
- WAF bot management
- Emergency virtual patching when a CMS CVE drops
- WAF for student portals without breaking SSO
- WAF for campus LMS sites without breaking courses
- WAF for athletics, news, and campus microsites
- Hide your origin IP behind a WAF (and allowlist edge IPs only)
- Campus DDoS response: keep .edu sites up under flood
- DIY WAF vs managed: console burden or operator?
- Managed WAF pricing: is $150/site worth it?
- Managed WAF for multi-site campus and agency estates
- Concierge DNS: we point your site at the managed WAF
- Managed WAF for multi-site teams
- Pricing
- Free security scan
- A client was taking 90 million requests an hour. The WAF was only half the fight.
- WAF Watch: Events Calendar RCE, Elementor uploads, Drupal table field
- WAF Watch: WooCommerce webshells, Drupal CKEditor, campus SAML
- WAF Watch: Click2Shell, Feide DDoS, Magento cleanup
- WAF Watch: PeopleSoft path tricks, WordPress LFI, Drupal Webform
- WAF Watch: A campus WordPress web shell, self-healing backdoors, FortiMail file writes
- WAF Watch: A CVSS 10 WordPress upload flaw, Ninja Forms hidden admins, a Drupal advisory pile-up