Services with login and payment running open, without a firewall
Known attack patterns are blocked at the front end, and every request that gets blocked is logged.
Web Security — WAF & DDoS
A web application firewall and DDoS defense sit in front of the service, so attacks never reach the server.
- Cloud
- Architecture
- Migration
- Managed operations
01Overview
Service overview
Web Security filters malicious requests with a web application firewall and stops large-scale traffic attacks in front of the service. The work happens at the front end, without touching the application's code. It can be added to a service that is already running, or built in from the start of a new one.
02Who it fits
Where it fits
Sites with heavy overseas traffic where abnormal requests are hard to tell apart
Rules are split by region and request pattern, separating genuine visitors from automated access.
Teams flagged in a security review who cannot pause their development schedule
A front-end rule blocks the issue first, with no code change, while the underlying fix is scheduled on its own timeline.
03What we deliver
Scope of delivery
01
WAF rule design and operation
Blocking rules are set to match the service and adjusted whenever a false positive turns up. The rules are never left alone once they are in place — the block log is reviewed and the rules are tuned on an ongoing basis.
02
DDoS defense
Large-scale request attacks are absorbed at the Akamai network layer before they reach the server. Even as an attack grows, there is no need to scale up the origin server to withstand it.
03
Certificates and access control
Certificate issuance and renewal run on an automated cycle, and paths that should never sit open — an admin page, for instance — are restricted. A missed renewal no longer takes the service down.
How the service works
Inspect and protect requests before they reach the service
Review request and blocking records, tune protection rules and manage certificates and access controls.
Inspect requests and risk conditions
Apply WAF and DDoS protection
Review blocks and tune rules
04Why this way
Points of difference
Each point lists the deliverable that backs it.
Built into services from the start, as standard
The web application firewall is not sold as a separate product — it goes into most of the services built here from day one. Running sites with heavy overseas traffic over several years has shaped the rules for what to block and what to let through.
Backed by
- Baseline assessment report
- Target architecture and transition plan
Client work · Live commerce
Live commerce, company B — the operating environment stood up alongside the build
The environment went up first, on the development schedule, and the same team carried the deployment and operations paths after it.
Learn moreDirect Akamai partner
Defense is handled directly, not sourced through layers of resellers. Because changing a WAF rule and reviewing the block log both happen in-house, there is no waiting on another company's reply before a call gets made.
Backed by
- Cutover record and operations runbook
- Operations dashboard and improvement backlog
Client work · North American food ordering platform
North American food ordering platform, company W — delivery and operations aimed overseas
A CDN moved delivery closer to the user, and the operations aimed at overseas users stayed with us in Korea.
Learn more05How to start
From first call to kickoff
Every stage ends with an agreed scope and a deliverable in your hands.
Step 01
Baseline
We collect current cost, performance, configuration, and ownership per account and turn them into a baseline within three weeks of kickoff.
DeliverableBaseline assessment report
Step 02
Target architecture
We set the target structure around business criticality and regulatory constraints, then fix the transition order and rollback conditions with you.
DeliverableTarget architecture and transition plan
Step 03
Transition and run
We cut over only after rehearsal, then move observability, cost, and incident response into a single operating model.
DeliverableCutover record and operations runbook
Step 04
Embed and improve
We review operating metrics with you once a month and agree the next quarter improvements in priority order.
DeliverableOperations dashboard and improvement backlog
06Contract options
Ways to work together
- Remote delivery
- Subscription
07Service levels
Service levels
99.95%
Uptime
30%+
Average savings after migration or redesign
24·7
Night-and-holiday coverage included
Stone manufacturer, company S — blocking abnormal requests on a globally accessed site
A stone products manufacturer, Company S, has heavy overseas traffic and is seeing a rise in abnormal requests on its site.
What we doRules are split by region and request pattern to filter out automated access, and the block log is reviewed to tune out false positives.
What it leavesAbnormal requests are cut at the front end while response times stay steady for genuine visitors.
Live commerce, company B — the operating environment stood up alongside the build
A new service had to be built and its cloud operating environment stood up at the same time.
What we doThe environment went up first, on the development schedule, and the same team carried the deployment and operations paths after it.
What it leavesDevelopment and infrastructure moved on one schedule instead of waiting on each other.
North American food ordering platform, company W — delivery and operations aimed overseas
A service used in California, USA had to be operated from Korea.
What we doA CDN moved delivery closer to the user, and the operations aimed at overseas users stayed with us in Korea.
What it leavesThe service area is abroad, and delivery and operations still run from Korea.
Ongoing
More pages, lighter operations: how IXC rebuilt its multilingual website
Built so that adding pages and languages does not make the site harder to run. IXC redesigned its website from MDX-based content operations to multilingual checks, cloud deployment, and security.
Completed
Checking requests beyond the app screen: a mobile app and server security testing case
Down to the requests that never appear on the app screen. Device, communication, authentication, and server permissions were inspected together, and the fixes were verified again.
09FAQ
Frequently asked questions
Yes. The change points the domain at the new front end, so the application code is not touched. The cutover moves in stages, timed to low-traffic windows.
No. We start from workload requirements and choose the provider and services from there. Managed services do carry a switching cost, so we agree at design time how much of the stack stays on standard technology.
Yes. We take on operations in stages and move recurring work into runbooks and automation to reduce the headcount required. Night and holiday coverage is split by service criticality when the contract is agreed.
Most work is designed for zero or minimal downtime. Where downtime is unavoidable we agree the rehearsal, the rollback trigger, and the acceptable outage window first, then schedule the change at the lowest-traffic hour.
We compile the baseline report within three weeks of kickoff. Current cost, performance, configuration, and operational ownership are collected by account to inform the target architecture, transition sequence, and rollback conditions.
We review operational metrics, incidents, and improvement tasks monthly. Priorities for the following quarter are recorded in the operational dashboard and improvement backlog to inform the next investment decisions.
We share the findings from the first stage, then agree scope and schedule on that basis before delivery. A finished request for proposal is not required: the current environment and the outcome you want are enough to start.
Security & Edge
2026-09-26 · 16 min read
Hundreds of vulnerabilities: what should you fix first?
Vulnerability remediation prioritization confirms which deployed assets are affected, then weighs exploitation evidence, attack paths and business impact.
Security & Edge
2026-09-26 · 15 min read
A secret key was exposed in a repository. Is deleting it enough?
Deleting the file leaves copied keys valid, so cut off an exposed secret first, then replace it at its consumers and investigate the impact.
Security & Edge
2026-09-26 · 17 min read
How far should a WAF exception go when legitimate requests are blocked?
Identify the inspection that conflicts with legitimate behavior, then limit a WAF exception to the necessary requests and rules.
12Related resources
Resources for this service
Guides and checklists you can use during review and kickoff.
See all resources
Guides
2026.09.04
CDN and WAF configuration checklist for overseas traffic
A checklist that works through response time, request filtering and origin traffic reduction when overseas access is slow or abnormal requests are rising.
Guides
2026.09.05
Reviewing a CDN and cross-border acceleration
A guide to deciding whether to put a CDN in front when overseas users see slow responses, and on which axes to choose how it is supplied.
Contact
Contact us
Tell us your current environment and target outcome, and our team will review it and reply.
Direct line
Phone lines are open weekdays 09:00–18:00
ServiceWeb Security — WAF & DDoS
Collection and use of personal information
- Purpose · Responding to and following up on this inquiry
- Items · Name, company, work email, message, visit source (first page visited, referring site domain, campaign parameters)
- Retention · 36 months from the date consent is given
You may decline; the inquiry cannot be submitted without consent.
More ways to explore