WAF & DDoS Protection: How to Secure Your Website Against Cyberattacks

Why Website Security Can No Longer Be an Afterthought

In 2024, cyberattacks cost businesses an estimated $9.5 trillion globally, according to Cybersecurity Ventures. That figure isn’t just about large corporations getting breached—it includes the e-commerce store that went offline for 48 hours due to a DDoS attack, the WordPress blog that got defaced through an SQL injection, and the SaaS platform that leaked customer data because of a misconfigured API.

The reality is stark: every website is a target. Whether you run a small Prestashop boutique or a high-traffic media platform, automated bots and malicious actors are scanning your site right now, probing for weaknesses.

Two of the most critical defenses in your security arsenal are a Web Application Firewall (WAF) and DDoS protection. Together, they form a layered shield that can block the vast majority of common cyberattacks before they ever reach your application.

Let’s break down how they work, how they differ, and—most importantly—how to implement them effectively.

Understanding WAF: Your Application’s Bodyguard

What a Web Application Firewall Actually Does

A Web Application Firewall (WAF) sits between your website and the internet. It inspects every incoming HTTP/HTTPS request in real time, analyzing headers, payloads, query strings, and cookies against a set of security rules.

When a request matches a known attack pattern—say, a SQL injection attempt hidden in a login form—the WAF blocks it instantly. The legitimate user never notices a thing. The attacker gets a 403 Forbidden response.

Here’s what a typical SQL injection attempt looks like:

GET /products?id=1' OR '1'='1'; DROP TABLE users;-- HTTP/1.1
Host: www.example.com

Without a WAF, this request might reach your database layer and cause catastrophic damage. With a properly configured WAF, it’s intercepted and dropped before it even touches your application.

Types of Threats a WAF Blocks

A modern WAF protects against the OWASP Top 10 vulnerabilities and more:

• SQL Injection (SQLi) — Manipulating database queries through user input
• Cross-Site Scripting (XSS) — Injecting malicious scripts into web pages
• Cross-Site Request Forgery (CSRF) — Tricking users into performing unwanted actions
• Remote File Inclusion (RFI) — Loading malicious files from external servers
• Directory Traversal — Accessing restricted files on the server
• Broken Authentication Exploits — Brute-force and credential stuffing attacks
• API Abuse — Exploiting improperly secured API endpoints

Cloud WAF vs. On-Premise WAF

Not all WAFs are created equal. Here’s a practical comparison:

Feature	Cloud WAF	On-Premise WAF
Deployment	Minutes (DNS change)	Hours to days (hardware/software setup)
Maintenance	Managed by provider	Managed by your team
Scalability	Auto-scales with traffic	Limited by hardware capacity
Cost (entry)	$20–$200/month	$5,000–$50,000+ upfront
Rule Updates	Automatic, real-time	Manual or semi-automated
Best For	SMBs, e-commerce, SaaS	Large enterprises with compliance needs

For the vast majority of businesses, a cloud-based WAF is the smarter choice. Solutions like Cloudflare WAF, AWS WAF, Sucuri, and Imperva offer enterprise-grade protection at a fraction of the cost of on-premise hardware.

At Lueur Externe, we frequently deploy and fine-tune AWS WAF configurations for our clients’ Prestashop and WordPress sites—leveraging our AWS Solutions Architect certification to ensure rules are optimized for performance and security alike.

DDoS Attacks: The Brute-Force Threat That Keeps Growing

What Is a DDoS Attack?

A Distributed Denial-of-Service (DDoS) attack aims to overwhelm your server, network, or application with a flood of traffic so massive that legitimate users can’t get through. Think of it as thousands of people trying to shove through a single doorway simultaneously—nobody gets in.

DDoS attacks have grown exponentially in both frequency and scale:

• In Q1 2024, Cloudflare reported blocking 4.5 million DDoS attacks—a 50% increase year-over-year
• The largest recorded DDoS attack peaked at 3.47 Tbps (Microsoft, 2024)
• The average DDoS attack duration is now around 68 minutes, but even a 10-minute outage can cost an e-commerce site thousands in lost revenue

The Three Layers of DDoS Attacks

DDoS attacks target different layers of the network stack, and each requires a different mitigation strategy:

Layer 3/4 — Volumetric and Protocol Attacks

These attacks flood your network with raw traffic. Examples include:

• UDP floods — Sending massive volumes of UDP packets to random ports
• SYN floods — Exploiting the TCP handshake process to exhaust server resources
• ICMP (ping) floods — Overwhelming the network with ping requests
• Amplification attacks — Using DNS, NTP, or memcached servers to multiply traffic volume by 50–600x

Layer 7 — Application-Layer Attacks

These are more sophisticated. Instead of brute-forcing bandwidth, they mimic legitimate user behavior:

• HTTP floods — Sending thousands of seemingly normal GET/POST requests
• Slowloris — Holding connections open for as long as possible to exhaust server threads
• Cache-busting attacks — Requesting unique URLs to bypass CDN caching and hit the origin server directly

Layer 7 attacks are particularly dangerous because they’re harder to distinguish from real traffic. This is exactly where a WAF with behavioral analysis becomes critical.

Real-World Impact: What a DDoS Attack Costs

Let’s put this in business terms. Consider a mid-sized Prestashop store generating €50,000/month in revenue:

• Average daily revenue: ~€1,667
• Revenue per hour: ~€69
• A 6-hour DDoS attack during peak hours: €415+ in direct lost sales
• Add customer trust damage, SEO ranking drops from downtime, and recovery costs: €2,000–€10,000+ total impact

For larger sites, the numbers scale dramatically. Amazon famously estimated that one second of downtime costs them $220,000 in lost revenue.

Building a Layered Defense: WAF + DDoS Protection Together

Why You Need Both

Here’s a critical point many site owners miss: a WAF alone won’t stop a volumetric DDoS attack, and DDoS protection alone won’t stop an SQL injection.

They address fundamentally different threat vectors:

• WAF → Protects the application layer from intelligent, targeted exploits
• DDoS mitigation → Protects the infrastructure from being overwhelmed by sheer volume

Think of it like a nightclub: DDoS protection is the crowd-control barrier outside the building, preventing a stampede. The WAF is the bouncer at the door, checking IDs and turning away troublemakers.

A Practical Architecture for Most Websites

Here’s a defense-in-depth architecture that works for most SMBs and mid-market websites:

[User Request]
     |
     v
[CDN / DDoS Shield]  ← Cloudflare, AWS CloudFront + Shield, Akamai
     |
     v
[Web Application Firewall]  ← AWS WAF, Cloudflare WAF, ModSecurity
     |
     v
[Rate Limiter / Bot Manager]  ← Blocks brute force, credential stuffing
     |
     v
[Load Balancer]  ← Distributes clean traffic across servers
     |
     v
[Origin Server(s)]  ← Your WordPress, Prestashop, or custom app
     |
     v
[Database Layer]  ← MySQL, PostgreSQL, etc.

Each layer filters out a different category of threat. By the time traffic reaches your origin server, the vast majority of malicious requests have already been eliminated.

Recommended Tools and Services

Here’s what we see performing well in production environments across different budgets:

For Small Businesses (< €100/month):

• Cloudflare Free/Pro (basic DDoS + WAF rules)
• Wordfence (WordPress-specific WAF)
• Sucuri Firewall ($199/year)

For Mid-Market (€100–€1,000/month):

• Cloudflare Business/Enterprise
• AWS WAF + AWS Shield Standard (included free with CloudFront)
• Imperva Cloud WAF

For Enterprise (€1,000+/month):

• AWS Shield Advanced ($3,000/month + data transfer costs)
• Akamai Kona Site Defender
• Fastly Next-Gen WAF (formerly Signal Sciences)

Configuring AWS WAF: A Practical Example

Since many of our clients at Lueur Externe run on AWS infrastructure, here’s a practical example of setting up AWS WAF rules using AWS CloudFormation (Infrastructure as Code):

Resources:
  WebACL:
    Type: AWS::WAFv2::WebACL
    Properties:
      Name: production-web-acl
      Scope: REGIONAL
      DefaultAction:
        Allow: {}
      Rules:
        - Name: AWSManagedRulesCommonRuleSet
          Priority: 1
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesCommonRuleSet
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: CommonRuleSetMetric
        - Name: AWSManagedRulesSQLiRuleSet
          Priority: 2
          Statement:
            ManagedRuleGroupStatement:
              VendorName: AWS
              Name: AWSManagedRulesSQLiRuleSet
          OverrideAction:
            None: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: SQLiRuleSetMetric
        - Name: RateLimitRule
          Priority: 3
          Statement:
            RateBasedStatement:
              Limit: 2000
              AggregateKeyType: IP
          Action:
            Block: {}
          VisibilityConfig:
            SampledRequestsEnabled: true
            CloudWatchMetricsEnabled: true
            MetricName: RateLimitMetric
      VisibilityConfig:
        SampledRequestsEnabled: true
        CloudWatchMetricsEnabled: true
        MetricName: ProductionWebACLMetric

This configuration does three things:

1. Common Rule Set — Blocks the most frequent web exploits (XSS, bad bots, etc.)
2. SQLi Rule Set — Specifically targets SQL injection patterns
3. Rate Limiting — Blocks any single IP that sends more than 2,000 requests in a 5-minute window (effective against simple HTTP floods)

This is a solid starting point, but production environments typically need custom rules tailored to the specific application. For a Prestashop site, for example, you’d want to whitelist payment gateway callbacks and admin panel IP ranges while applying stricter rules to public-facing product and search pages.

Essential Security Hygiene Beyond WAF and DDoS

A WAF and DDoS protection are critical, but they’re not a silver bullet. Here are additional measures every site owner should implement:

• Keep all software updated — 60% of breaches involve unpatched vulnerabilities (Verizon DBIR 2024)
• Use HTTPS everywhere — Encrypt all traffic with TLS 1.2 or 1.3
• Implement Content Security Policy (CSP) headers — Mitigate XSS even if an attack bypasses your WAF
• Enable two-factor authentication (2FA) — Especially on admin panels and CMS backends
• Regular backups with tested restoration — When all else fails, you need a clean restore point
• Monitor and log everything — You can’t defend against what you can’t see. Use tools like AWS CloudWatch, Datadog, or Grafana
• Security headers — Add X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security, and Referrer-Policy headers

Quick Security Header Check

You can test your site’s security headers in seconds using a tool like securityheaders.com. An A+ rating should be your target. Here’s what the recommended headers look like in an Nginx configuration:

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.com;" always;

Common Mistakes That Leave Websites Vulnerable

After two decades of building and securing websites, here are the mistakes we see most often:

1. “We’re too small to be attacked” — Bots don’t discriminate. Automated scanners hit every IP on the internet, regardless of company size.

2. Setting up a WAF and forgetting about it — Threat landscapes evolve weekly. WAF rules need regular tuning and review.

3. No rate limiting on login pages — Without rate limiting, attackers can try thousands of password combinations per minute.

4. Exposing admin panels to the public internet — Your /wp-admin or Prestashop /admin directory should be IP-restricted or behind VPN.

5. Using security plugins as the only defense — A WordPress security plugin is helpful but is no substitute for a network-level WAF.

6. No incident response plan — When an attack happens (not if), do you know who to call and what to do in the first 15 minutes?

The Business Case for Proactive Security

Security spending isn’t a cost—it’s insurance. Consider these numbers:

• Average cost of a data breach for an SMB: $120,000–$1.24 million (IBM Cost of a Data Breach Report 2024)
• Average cost of proper WAF + DDoS protection: $50–$500/month
• Google can deindex your site within hours if it detects malware, destroying months of SEO work
• GDPR fines for inadequate security can reach €20 million or 4% of annual turnover

The math is simple. A few hundred dollars per month in prevention can save you six or seven figures in damages.

Conclusion: Don’t Wait for the Attack to Start Defending

Cyberattacks aren’t slowing down—they’re accelerating in both volume and sophistication. A Web Application Firewall protects your application from targeted exploits like SQL injection and XSS. DDoS mitigation shields your infrastructure from being overwhelmed by malicious traffic floods. Together, they form the backbone of any serious web security strategy.

But deploying these tools effectively requires more than just flipping a switch. It takes proper architecture design, rule tuning, ongoing monitoring, and deep understanding of how web applications work under pressure.

That’s where working with experienced specialists makes the difference. At Lueur Externe, we’ve been securing websites since 2003. As certified AWS Solutions Architects and Prestashop experts based in the Alpes-Maritimes (06), we help businesses implement robust, layered security strategies that protect revenue, data, and reputation.

Don’t wait for your first attack to take security seriously. Contact Lueur Externe today for a comprehensive security audit of your website—and sleep better knowing your digital assets are protected.