03 · IT Security
DDoS protection and WAF with Cloudflare
We put your websites, applications and APIs behind Cloudflare: volumetric attacks stopped at the edge, a managed WAF against OWASP Top 10, bot control and a CDN that makes the site faster at the same time.
Service details
Why does it matter for your business?
Faster applications
As part of the service, we deploy the Cloudflare CDN — which can cut load times by tens of percent.
Full application-layer protection
The WAF blocks malicious requests, including SQLi, XSS, bots, L7 DDoS and OWASP Top 10 exploits.
24/7 business continuity
Preventing attacks that block access to your services — no more downtime and lost revenue.
Easy domain parking
Park your domain on Cloudflare DNS in just a few minutes.
Lower incident and downtime costs
An attack lasting a few minutes can cost thousands of PLN. We keep the risk to a minimum.
Regulatory compliance
Support for security requirements in supervised and standards-driven sectors (including NIS2, PCI DSS, GDPR, DORA).
Platform
We work with Cloudflare — a global leader in edge security
Your traffic reaches Cloudflare's global network first. Attacks are filtered there, far from your servers, and only clean requests are passed to the origin. We design the policies, deploy them and tune them so legitimate users never notice the protection.
DDoS protection
Automatic analysis and blocking of volumetric and protocol attacks (L3/L4) within milliseconds, with no limit on attack volume.
Web Application Firewall
Managed rule sets updated in real time plus your own rules: SQL injection, XSS, OWASP Top 10 exploits and application-layer (L7) floods.
CDN and caching
Static content served from edge locations close to your users — often cutting load times by tens of percent and reducing origin load.
Bot management
Telling real customers from scrapers, credential-stuffing tools and fake traffic — without CAPTCHAs for everyone.
API protection and rate limiting
Rate limits, schema validation and rules for API endpoints, so a single client cannot exhaust your backend.
Zero Trust access
Access to admin panels and internal applications based on identity instead of a VPN, with logging of every session.
DNS, TLS and encryption
Fast authoritative DNS with DNSSEC, certificates, modern TLS and encrypted traffic all the way to the origin.
Logs and analytics
Visibility into what was blocked and why — and, on request, forwarding of events to your SIEM or our SOC.
Load balancing and failover
Traffic spread across several origins with health checks, so a failure of one server does not take the service down.
How it works
Your traffic, filtered before it reaches you
What we do in the engagement
- Analysis of current threats and security requirements
- Selection of the optimal Cloudflare plan (Free, Pro, Business or Enterprise)
- Design and configuration of DDoS and WAF policies
- DNS migration with no downtime
- CDN integration and performance optimization
- Tuning rules so legitimate users and integrations are never blocked
- Monitoring, response during attacks and regular reviews
- Emergency onboarding when you are already under attack
A 30-minute call with an engineer — we'll review your setup and propose a protection plan.
Which plan
Cloudflare plan — what actually changes
| Plan | What you get | Typically for |
|---|---|---|
| Free | Unmetered DDoS protection, CDN, DNS, TLS certificate | Small sites that mainly need to stop volumetric attacks |
| Pro | Managed WAF rule sets, image optimization, better analytics | Business websites and shops |
| Business | Advanced WAF and bot rules, custom certificates, priority support | E-commerce and applications with real revenue at stake |
| Enterprise | Contractual SLA, advanced bot management, logs to SIEM, dedicated support | Regulated sectors and high-traffic platforms |
We recommend the smallest plan that meets your requirements — and say so when the free one is enough.
Compliance
Protection against attacks and application-layer filtering support the security requirements of supervised and standards-driven sectors, including NIS2, DORA, PCI DSS and GDPR. Event logs can serve as evidence during audits.
Questions and answers
DDoS and WAF FAQ
What is a DDoS attack?
A distributed denial-of-service attack floods your website, application or network with traffic from many sources at once, until legitimate users can no longer get through. Attacks range from simple volumetric floods to sophisticated application-layer requests that look almost like real users.
How quickly does protection react?
Volumetric attacks are detected and blocked automatically at the edge within milliseconds, without any action on your side. Application-layer attacks are handled by WAF and rate-limiting rules, which we tune for your traffic patterns.
Do we have to change our hosting provider?
No. The protection works in front of your current infrastructure, wherever it is hosted. In most cases all that changes is where your domain's DNS is served from.
Will it slow our website down?
Usually the opposite. Static content is served from an edge location near the user and the connection to the origin is optimized, so pages load faster — which also improves Core Web Vitals and your position in Google.
Can it protect an API or a non-HTTP service?
Yes. APIs are protected with WAF rules, rate limiting and schema validation. For non-HTTP services — for example mail, game or database traffic — we use TCP/UDP proxying on Enterprise plans.
What if the WAF blocks our own integrations?
That is what tuning is for. We start in monitoring mode, review what would have been blocked, whitelist your integrations and only then switch rules to blocking — and we keep adjusting them as your application changes.
Can attackers bypass the protection by attacking our IP directly?
Not if the origin is locked down. As part of the deployment we restrict the server to accept traffic only from Cloudflare, so the real IP address of your infrastructure is no longer a target.
We are under attack right now. Can you help today?
Yes. Emergency onboarding usually means changing the DNS and applying protective rules quickly — most deployments take from one to five days, but an environment under attack can be put behind protection much faster. Contact us and describe the situation.
What does the service cost?
The cost has two parts: the Cloudflare subscription (from free to Enterprise) and our work — deployment, rule design and ongoing care. After a short call you get a proposal with scope and price within 48 hours.
Do you monitor the protection afterwards?
Yes. We watch the attack and block analytics, adjust rules and report what happened. The events can also be forwarded to your SIEM or monitored around the clock by our SOC.
Related services
Often combined with this service
First step
Let's talk about DDoS protection and WAF.
30 minutes, no slide deck. We'll tell you straight whether this service solves your problem, what scope makes sense and how much it costs.
A proposal with scope and pricing within 48 hours of the call.
Go to contact