What a WAF does
A web application firewall (WAF) sits between the internet and your site. Every incoming request passes through it first. It inspects the traffic, decides whether it looks legitimate, and either lets it through or drops it.
The one we deployed is open-source, built on industry-standard rule sets that are continuously updated to match known threats. It’s proven infrastructure used in production environments all over the world, not an experiment.
Why this runs at the infrastructure level and not within WordPress
Most WordPress security solutions are plugins. Wordfence, Sucuri, iThemes. They all work the same basic way: they install inside WordPress and use your site’s own resources to inspect incoming traffic.
That means every request, legitimate or malicious, has to load WordPress, spin up PHP, load the plugin, and then decide whether the visitor is a threat. Your server does the work of processing an attack before it can block it. During a brute-force attempt or a bot swarm, that’s hundreds or thousands of extra requests your server has to deal with. Your site slows down while it’s busy defending itself.
Our WAF doesn’t work that way. It runs at the infrastructure level, in front of WordPress entirely. Malicious traffic gets dropped before it touches your site. WordPress never sees it, your server never processes it. No extra CPU, no extra memory, no extra load time.
There’s another advantage: it can’t be bypassed through a compromised plugin or a WordPress vulnerability. If an attacker exploits a plugin flaw to disable security features, a plugin-based WAF goes down with it. An infrastructure-level WAF doesn’t care what happens inside WordPress. It’s a separate system running independently.
And because it’s centralized, we manage the rules and updates once and every site on the platform gets the protection simultaneously. No waiting for individual site owners to update a plugin. No inconsistencies between sites.
What it protects against
Without getting into specifics that would help the wrong people, here’s the general picture:
- Common web application attacks. SQL injection, cross-site scripting (XSS), and the rest of the OWASP Top 10. Blocked by default using established rule sets.
- Brute-force login attempts. WordPress login pages get targeted by bots constantly. The WAF applies rate limiting and blocks repeat offenders at the network edge, before they reach your login page.
- Malicious bots. Not all bots are bad. Search engine crawlers are bots, and you want those. But scrapers, spammers, and vulnerability scanners probing your site for weaknesses? The WAF identifies and drops those.
- DDoS mitigation. A distributed denial-of-service attack floods your server with so much traffic it can’t respond to real visitors. A plugin can’t stop this because by the time the plugin runs, the server is already overwhelmed. The WAF handles connection limiting and traffic shaping before requests hit your server.
- HTTP security headers. HSTS, content security policies, and similar headers that tell browsers how to handle your site securely. These are now applied automatically and consistently.
None of this requires you to configure anything or install anything.
Why we’re telling you this
We could have rolled this out and said nothing. You’d never notice the difference, which is kind of the point. Good security is invisible. You only notice it when it fails.
But we think it’s worth being transparent about what we do and why. This is what we mean when we say our hosting is proactive, not reactive. It’s infrastructure that someone is actively improving, hardening, and watching.
Most hosting companies would make this a premium add-on. “Advanced security, $10/month extra”. We’re not doing that. Every site on our platform gets the same protection, because every site deserves it. It’s part of the job.
This is also how we think about the relationship with our clients. We don’t wait for you to ask “is my site secure?” and then offer to sell you a solution. We assume you expect your site to be secure, and we make sure it is.
One less thing to worry about
If you’re an Awwwsome hosting client, there’s nothing you need to do. The WAF is already running, already protecting your site, and already included in your plan.
If you had a WordPress security plugin installed before, it’s not necessarily redundant. Defense in depth is a real thing, and layers of protection are generally better than one. But you might find you no longer need the heaviest, most resource-hungry security plugin in your stack. If you want to talk through what makes sense for your site specifically, just reach out.
The whole point of managed hosting is that you shouldn’t have to become a security expert to keep your website safe.