WAF management run
by Umbraco specialists

We've been running WAFs in production in front of Umbraco for years, including across our own GreenStack platform. That means we've seen the rule that breaks the backoffice every time a content editor tries to paste an image, the geo block that quietly kept a German manufacturer's regional sales team off their own CMS, and the bot rule that turned a legitimate uptime monitor into a steady stream of false-positive alerts at 03:00. Most of the work in a WAF isn't switching it on, it's making sure it doesn't block the people you actually want to serve.

The platforms we run regularly: Cloudflare WAF and Bot Management, Azure Front Door WAF, Azure Application Gateway WAF, and on-prem appliances where required. The work covers custom rule authoring, OWASP Core Rule Set tuning, rate limiting on authentication and form endpoints, geo and ASN policy, bot management, and the structured review of WAF events so the noise stays separated from the signal. For Umbraco specifically we handle backoffice path protection, surface controller exceptions, media URL allow-lists, and the login and password-reset endpoints that attract the most automated traffic as standard.

Whether you've just had a security review tell you a WAF is mandatory, you're running one that nobody has tuned in two years, or you need someone accountable for the rules and the alerts so your developers don't have to be, we'll scope it, configure it, and run it.