And today we\u2019ll be covering how to implement the WAF with WPMU DEV.<\/p>\n
In this post:<\/p>\n
- \n
- What is a WAF?<\/a><\/li>\n
- WPMU DEV’s WAF<\/a><\/li>\n
- You Can Never Have Too Much WordPress Security<\/a><\/li>\n
- Choose Your Own WAF Path<\/a><\/li>\n<\/ul>\n
We\u2019ll give you a quick run-through of WPMU DEV\u2019s WAF<\/a>, which is completely free<\/strong> to use as part of our managed hosting<\/a> service.<\/p>\n
We’re always hard at work testing and fine-tuning this puppy – ensuring it’s giving you the best web application protection possible.<\/p>\n
Unlike most in-built security plugin WAFs, ours also forms a protective wall OUTSIDE of your WP borders.<\/p>\n
We’ll get into why this is super important later… but first, let\u2019s start with the basics:<\/p>\n
What is a WAF?<\/h2>\n
A Web Application Firewall<\/a> (WAF) is a specific type of firewall that protects your web applications from malicious application-based attacks.<\/p>\n
WAFs act as the middle person, or security guard for your WordPress site.<\/p>\n
Standing guard between the internet and your web applications, all the while monitoring and filtering the HTTP traffic that wants to join your bumping party.<\/p>\n
Of course, like any raging WP party, there are always gate-crashers to worry about.<\/p>\n
The good news is, WAFs use a set of rules (or policies) to help identify who\u2019s actually on your guest list, and who\u2019s just looking to cause trouble.<\/p>\n
\n\n![\"WAFs](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/Dev_Man_With_Guest_List-copy.jpg\")
You’re not getting past a WAF unless you can be trusted.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n Instead of going over all the details in this article, you can get a 360-degree look at WAFs, including how to implement them, what they help protect against, the different types of WAFs, and more in our article Everything You Need to Know About WAFs<\/a>.<\/p>\n
For now, let’s get to the main attraction…<\/p>\n
WPMU DEV\u2019s WAF<\/h2>\n
\n\nA while back we introduced our own WAF<\/a> which is enabled by default for all new users and comes completely FREE<\/strong> with our hosting<\/a>.<\/p>\n
Unlike plugins, our WAF builds a fence on the OUTSIDE of your house as it analyzes all traffic before it hits WordPress.<\/p>\n
We’ve done extensive testing and fine-tuning to ensure it will not slow your site down. And we keep it updated with the latest rules, and add any new known vulnerability footprints nightly.<\/p>\n
![\"A](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/waf-rules.png\")
A snapshot of how our WAF works to detect, filter, and block malicious traffic.<\/figcaption><\/figure>\n It also couldn\u2019t be easier to manage!<\/p>\n
To access and activate our WAF (if you\u2019re a member) simply navigate to our Website Hub<\/a> and click on the website you\u2019d like to set up or manage your firewall on.<\/p>\n
\n![\"Start](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/Hub-website.png\")
<\/div>\nYou can then access the firewall through either the “Hosting”<\/strong> or the “Security”<\/strong> tabs. For this example let’s go through Hosting.<\/p>\n<\/div>\n
\n![\"Click](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/waf-security-tools.png\")
<\/div>\n<\/div>\n<\/div>\n<\/div>\n\nNext, select the \u201ctools\u201d<\/strong> toolbar, and then you should see the \u201cWeb Application Firewall\u201d<\/strong> option.<\/p>\n
\n\n\n\n\n![\"Click](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/WAF-select-1.png\")
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\nOnce you\u2019ve clicked through, you\u2019ll be given the option to protect your site with our firewall.<\/p>\n
After you elect to do so, the firewall will activate and begin protecting your site.<\/p>\n
\n![\"Here's](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/WAF-toggle.jpg\")
<\/div>\n<\/div>\nYou\u2019ll also now see the \u201cAllowlist\u201d<\/strong> and \u201cBlocklist\u201d<\/strong> fields that appear below.<\/p>\n
We already maintain a set of rules that will identify unsafe traffic – but as mentioned above, admins can Allowlist (allow) or Blocklist (block) IP addresses and user agents as they see fit by filling out these fields.<\/p>\n
\n\n\n![\"Choose](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/block-allow-list.png\")
<\/div>\n<\/div>\n<\/div>\n<\/div>\nScroll past the allow listing and blocklisting rules and you’ll find our final WAF feature: The ability to disable specific WAF rule Ids. <\/strong><\/p>\n<\/div>\n
This feature can come in handy if specific WAF rules are not compatible with your site, and are causing false alarms.<\/p>\n
Simply enter the rule Id that’s causing problems, and it’ll be immediately disabled.<\/p>\n
Rule Ids and errors can be found in your “WAF Log.”<\/strong><\/p>\n
![\"If](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/WAF-disable-rule.png\")
<\/div>\nThe WAF log itself can be found\u00a0under the \u201cLogs\u201d<\/strong> tab, which is in the same toolbar as \u201cTools\u201d<\/strong> was above.<\/p>\n
\n![\"Use](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/waf-log.png\")
<\/p>\nLogs can come in handy when you want to see where attacks are coming from, which requests have been blocked, and what rules those requests triggered.<\/p>\n<\/div>\n
For example, let\u2019s say you\u2019re performing a valid action on your site, and for some reason, you get blocked.<\/p>\n
The logs allow you to understand exactly why this happened, so you can allowlist a particular IP, or disable a specific WAF rule.<\/p>\n
After all, you wouldn’t want your security guard kicking your best friends out of the club!<\/p>\n
And don\u2019t worry, if this sounds at all complicated, our members get access to 24\/7 round the clock support<\/a>, and someone will always be on hand to help out with any difficulties.<\/p>\n
You Can Never Have Too Much WordPress Security<\/h2>\n
As I touched on earlier, WAFs aren\u2019t the answer to ALL of your security problems.<\/p>\n
Doing simple things like installing a Network Firewall, keeping WordPress up to date, ensuring your PHP is up to date<\/a>, and making sure your sites are constantly backed up<\/a> – can all go a long way to protecting your sites.<\/p>\n
And although we don\u2019t think a WAF belongs inside of a plugin, security plugins still have their place and can be a handy last line of defense.<\/p>\n
Speaking of WordPress security plugins, you can\u2019t go past our own Defender.<\/a><\/p>\n
\n\n![\"Our](\"https:\/\/wpmudev.com\/blog\/wp-content\/uploads\/2020\/04\/defender-waf.png\")
Bots and hackers are no match for our Defender.<\/figcaption><\/figure>\n<\/div>\n<\/div>\n Yep, this guy\u2019s as mean as he looks when it comes to fighting off hackers and bots<\/a> (although he\u2019s a teddy bear outside of the cyber-security ring).<\/p>\n
In short, Defender can also help protect you from\u00a0Brute force attacks, SQL injections, Cross-site scripting XSS, and more!<\/p>\n
He also handles operations like malware scans and two-factor authentication login security.<\/p>\n
Choose Your Own WAF Path<\/h2>\n
Don\u2019t you just love it when the conclusion of an article ends with \u201cit depends\u201d?<\/em><\/strong><\/p>\n
Well, sorry to be a bummer, but when answering the question of: \u201cDo I need a WAF?\u201d<\/em><\/p>\n
It does indeed depend on your personal situation!<\/strong><\/p>\n
Do you need one? No. Should<\/em> you have one? Of course!<\/p>\n
The more security layers you can cover, the safer your and your client\u2019s data will be.<\/p>\n
Speaking of client data, if your website does collect client data it\u2019s vital that you have extra security measures like WAFs and Network Firewalls in place.<\/p>\n
Not just for protection, but to protect your reputation, and to adhere to website security regulations and standards.<\/p>\n
This is especially important for eCommerce sites, and sites that handle a ton of monetary transactions every day.<\/p>\n
We\u2019re Not Ones To Toot Our Own Horn, But…<\/h2>\n
As mentioned earlier, we have WAF as part of our hosting service<\/a>, and we’d love for you to try it at no risk with a WPMU DEV membership free trial.<\/a><\/p>\n
Finally, if you\u2019re already a WPMU DEV member and you don\u2019t currently host any sites with us, be sure to migrate a site over, or whip up a test site if you want to give our new WAF a no-hassle whirl.<\/p>\n
Other than that, stay cyber-safe out there folks!<\/p>\n","protected":false},"excerpt":{"rendered":"
If a cyberattack targeting your web applications never reaches your website, did the attack even happen? The answer is YES, and it was most likely a WAF that stopped it. In this article learn more about this intuitive firewall that is offered with WPMU DEV’s hosting (for free!). Today could be the day you meet […]<\/p>\n","protected":false},"author":775041,"featured_media":186706,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"blog_reading_time":"12","wds_primary_category":0,"wds_primary_tutorials_categories":0,"footnotes":""},"categories":[263,11260,11259,11119],"tags":[],"tutorials_categories":[11233],"class_list":["post-186704","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorials","category-wpmu-dev-products","category-wpmudev-tutorials","category-wordpress-hosting","tutorials_categories-hosting"],"_links":{"self":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/186704","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/users\/775041"}],"replies":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/comments?post=186704"}],"version-history":[{"count":103,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/186704\/revisions"}],"predecessor-version":[{"id":215661,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/posts\/186704\/revisions\/215661"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media\/186706"}],"wp:attachment":[{"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/media?parent=186704"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/categories?post=186704"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tags?post=186704"},{"taxonomy":"tutorials_categories","embeddable":true,"href":"https:\/\/wpmudev.com\/blog\/wp-json\/wp\/v2\/tutorials_categories?post=186704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- WPMU DEV’s WAF<\/a><\/li>\n