Website security is often seen as an IT responsibility, but it has a direct impact on marketing and communications teams who typically manage the website.
If your website goes down, slows significantly, or is compromised, it affects your ability to deliver services, communicate with the community, and maintain trust.
One of the simplest ways to strengthen your website’s security is by using a Web Application Firewall (WAF).
This article breaks down what a WAF is, why it matters, and what to do next.
What is a Web Application Firewall?
A Web Application Firewall (WAF) sits between your website and incoming traffic. Its job is simple: filter and block malicious requests before they reach your website.
Think of it as a security guard at the front door of your site. It inspects traffic and stops things like:
- Bots trying to exploit vulnerabilities
- Suspicious login attempts
- Spam and malicious form submissions
- Distributed Denial of Service (DDoS) attacks
Without a WAF, that traffic goes straight to your website.
Why it’s important to have a Website Application Firewall
For marketing and communications teams, the website is a key service delivery channel. If it goes down or becomes unreliable, it directly impacts your ability to communicate with the community.
A WAF helps by:
- Keeping your site online during traffic spikes or attacks
- Protecting forms and user interactions (e.g. applications)
- Reducing risk of data breaches or defacement
- Improving performance (many WAFs also include caching and CDN features)
In short, it adds a layer of protection that most websites don’t have by default. It’s also worth noting that a WAF is one of the only effective ways to protect against DDoS attacks, regardless of your website's hosting environment (shared or dedicated).
What are the risks if you don’t have one?
Without a WAF, your website is more exposed. Common risks include:
- Automated attacks - bots constantly scanning for vulnerabilities
- Website downtime - especially from traffic floods or DDoS attempts
- Spam and abuse - forms being flooded with junk submissions
- Security breaches - if vulnerabilities exist, they’re easier to exploit
- Reputational damage - if your site is defaced or unavailable
You don’t need to be a “high-profile” organisation to be affected. Most attacks are automated and opportunistic.
How a WAF is typically set up
The good news is that setting up a WAF is usually straightforward, especially with cloud-based options. At a high level, the process looks like:
- Choose a WAF provider (e.g. Cloudflare or Sucuri)
- Update your DNS settings to route traffic through the WAF
- Configure security rules (many providers include strong defaults)
- Test and monitor to ensure everything is working as expected
This is typically handled by your IT team, so you don’t need to manage the technical setup yourself. We can support initial setup and implementation of a WAF, working alongside your IT team. Ongoing management and custom rule configuration is typically handled internally.
WAF options: Cloudflare vs Sucuri
Two of the most common options we see for Local Government websites are Cloudflare and Sucuri.
Cloudflare
Cloudflare is one of the most widely used web infrastructure platforms globally.
What it includes:
- WAF (on paid plans)
- Global CDN (content delivery network)
- DDoS protection
- Performance optimisation (caching, speed improvements)
- Bot management
Strengths:
- Strong performance benefits (faster load times)
- Scalable and widely adopted
- Good balance of security + performance
- Free plan available (limited WAF features)
Things to note:
- Full WAF functionality requires a paid plan
- Can be more complex depending on configuration
- Cloudflare requires you to route your DNS through their platform, which may not suit all organisations (particularly some government IT policies)
Sucuri
Sucuri is more security-focused and purpose-built for website protection.
What it includes:
- WAF (included in plans)
- Malware detection and removal
- Security monitoring and alerts
- DDoS protection
- Website cleanup if compromised
Strengths:
- Security-first approach
- Includes incident response (cleanup support)
- Simpler, more “hands-off” setup
Things to note:
- Less focus on performance/CDN compared to Cloudflare
- No free tier
- Does not require full DNS control in the same way as Cloudflare (can be easier to adopt in some environments)
Where marketing and comms teams fit in
This isn’t something you need to implement yourself, but it is something you should be aware of.
If your website is critical to:
- service delivery
- consultations
- applications or transactions
...then security and uptime directly affect your work.
A good next step is to:
- Check if a WAF is already in place
- Speak with your IT team about current website security measures
- Ensure it’s considered as part of any future website upgrades
Final thought
WAFs aren’t new, but they’re becoming increasingly important as automated attacks become more common. For most organisations, having a WAF in place is a simple and effective way to reduce risk and improve reliability.