Can't see the forest for the trees
The year is 2023. The internet is nearly as basic as electricity; scientists claim that the quantum computer is about to arrive; Twitter was bought by Musk; and the word "cyber" is more common than the flu. Publications, reviews of events, and articles about sophisticated cyber systems that will help us protect our website flood us from every direction. The problem: with so many materials, experts and consultants, we have gotten lost. If you feel this way, you are not alone. It turns out that even among technical professionals, and even those who work in the cyber field itself, there is quite a bit of confusion.
In a series of short articles, of which this is the first, we will try to touch in a clear and easy way on various topics related to WordPress site security, improving its performance and other related subjects. The goal is not to weary you with technical terms and concepts you have already heard many times, but to focus on providing useful and important insights and tools in these areas, without complicating or making things difficult.
In this article we will deal with one of the most effective and basic tools for improving the protection of our WordPress site (and of sites in general): the WAF, or by its full name: Web application firewall.
Security layers: the firewall filters network traffic, and the WAF adds application-level protection before requests reach the web server. Original Hebrew illustration.Wait, aren't WAF and Firewall actually the same thing?
Despite the shared semantic denominator, WAF and Firewall are two different things. Both are important protection systems, but they operate against different types of threats and at different layers. The familiar firewall, the classic Firewall (which has also undergone changes and developments and today provides a broader response, but that is for another article), is a protection system that filters network traffic. Similar to the border control officer at the airport who verifies that the passenger is even authorized to cross the border, the Firewall will check, for example, whether the IP address trying to access the network is authorized and does not appear in a database of suspicious addresses that it holds. Without the firewall, any address could in fact cross the threshold and reach the local network. In more "technical" language, and according to the famous 7-layer model (OSI), the classic firewall operates at layers 3 and 4, and protects at these layers the transfer of data and network traffic.
But unfortunately, as we all understand, the fact that a border control officer allowed a traveler to pass after verifying their identity is no guarantee that the traveler is not plotting something malicious. The same is true in our case. The firewall plays a vital but rather limited role, and it is neither intended nor claims to stop many types of attacks aimed at our website. Those attacks will not be stopped by the firewall. What will stand between the attacker, whom the firewall did not notice at all, and our website is, among other things, The WAF system.
The WAF is the big security guard standing at the entrance to our website
If we compared the "firewall" earlier to a border inspector – the party supervising traffic – then the WAF can be likened to a security guard standing at the entrance to the website itself, and protects it from a very large variety of risks, ones that, as stated, the firewall is not designed to repel. In more technical language, if we return to the 7-layer model mentioned above (OSI), we can say that a WAF system operates at layer 7, the last one, that is, the application layer. The well-known OWASP project deals with ranking the risks to web applications and ranks them according to severity and additional parameters, based on ongoing analysis of a huge number of information security events from various sources, including the world's leading knowledge bodies. The WAF system is intended to provide a significant layer of protection against a large part of those security vulnerabilities and will significantly improve the website's resilience against them.
We will not belabor the point and will settle for three examples of such vulnerabilities, common, well-known and painful: SQL Injection, XSS attacks and DDos attacks. The first is in fact the exploitation of a weakness (often stemming from an innocent mistake by the developer when building the site) that allows an attacker to modify the database, obtain information from it, "engineer" it as they wish, including making themselves the "site administrator," with everything that implies. XSS (Cross Site Scripting), which is no less common, is usually carried out by exploiting a vulnerability (for example in some plugin) in order to inject a malicious script into the code of a trusted site, and to lure the user, the visitor, into clicking on it, which may harm the site's display and cause various other mischief (such as theft of a "user ID" and more). A suitable WAF also serves as significant protection against DDoS attacks at the application layer – attacks that involve launching a flood of "requests" at a site until it crashes.
The WAF thus stands at the entrance to the website and monitors the requests arriving at the site, according to the system's rule set. The WAF essentially "decides" whether the request received from the visitor (say, to display a particular page they tried to access on the website) is legitimate. If the system assesses that the request is not authorized, the visitor will be denied and receive an error message. The WAF also lets you define various "rules", such as blocking visitors from certain countries, blocking visitors from a certain User-Agent (very relevant for blocking bots), blocking visitors from a certain source (say, visitors who reach our site through a certain app or social network), and more, but we will expand on these things, and on additional features, on another occasion.
How is all this related to my humble WordPress site, and what does it have to do with laziness?
WordPress is the most widely used content management system on the web, by a huge margin over the others. Its advantages are many and well known. With relative ease you can build impressive, fast and quite powerful sites. The community that has developed around the platform is among the most extensive and productive in existence, and it includes tens of thousands of plugins, a huge number of themes and kits, and many versions. Most of them are free, and a large share are available for a relatively small fee. But there is no good without bad, and the abundance, ease and great modularity also bring many risks. A considerable share of sites are built in a way that is far from optimal, to put it mildly, and without taking into account many technical points of failure. Just as critically, a large share of sites, even ones that were built properly at the time, are not maintained and not managed on an ongoing basis, and certainly not in the thorough manner required in order to track and keep up with the pace of published vulnerabilities and the required fixes and updates.
Without a doubt, the good, correct and responsible way to protect a WordPress site is through ongoing diligence in updating components, updating versions, and dealing with the many vulnerabilities that are continuously published. Admittedly, this does not guarantee complete prevention of breaches, and it seems that in 2023 everyone already understands that no system is completely immune to attack and damage, but it does greatly reduce the site's vulnerability and gives it a decent level of security. Unfortunately, and to tell the truth, a considerable portion of site owners and related professionals fail to achieve this. The many challenges of managing any business lead many of us to ignore the various risks. Sometimes it is purely a budget matter, sometimes simply a lack of time and prioritization, sometimes a lack of awareness, and sometimes just procrastination and turning a blind eye.
A proper WAF system will thus provide an additional, effective layer of protection for any website, but it is far more critical for those sites that were built in a non-optimal way, and for those that are not managed, updated and maintained continuously and regularly by a skilled and dedicated technical person. So there is no real substitute for thorough, ongoing care of a site, but there is no doubt that for a site whose owner "sins" in the aforementioned matters, the WAF is even more important, and can significantly reduce a large part of the known risks and prevent "accidents" whose consequences may be severe.
On the market you can find several worthy and good WAF systems, more advanced and less advanced, and it is highly recommended to consider using one of them. uPress uses many protection products to secure its systems and helps its customers improve the protection of their sites through various tools. In the field of WAF systems, uPress customers have the option of strengthening their site's protection, among other things, through one of the leading premium WAF systems from the security giant F5. But as mentioned, there are other excellent and recommended WAF systems on the market, each with its own features and advantages, and it is well worth examining the use of one of them. We highly recommend doing so.
Want to hear more? Have questions? As usual, feel free to send us a message and we will be happy to help.
