Businesses Private clients
Remote assistance Help
Paying as a business Bank transfer via SWIFT, or card Is this invoice genuinely ours? PDF, ebInterface and ZUGFeRD
Deutsch English
Send an enquiry
Services
Solutions
Pricing
Training
About Apply
Contact
Send an enquiry
Browse the catalogue: 80 services in 18 areas
Managed IT services Your IT team without the office desk: devices, logins and servers kept running from afar All-inclusive IT support One flat monthly price covering PCs, Microsoft 365 and your servers IT helpdesk Staff report an issue via mail, portal or a Teams chat and get screen-share help fast Service desk One front door for all requests, priorities tied to the SLA, a monthly summary for the boss Round-the-clock support Engineers on standby overnight, at weekends and over public holidays Start, Business and Premium plans Monthly care starting at €890 plus VAT
Service plans and SLAs Contractual reaction times of 4 hours, 1 hour or 15 minutes System administration Logins, virtual hosts, shared drives and infected machines, all fixed through an encrypted session IT infrastructure A candid stocktake, quicker machines and desktops streamed from the cloud Network and telephony Firewall and WLAN audited, connections watched, calls handled inside Microsoft Teams Cloud and hostingNew Servers, shop hosting, S3 storage and mailboxes hosted in Austria or elsewhere in the EU Backup and recovery Copies kept off the premises, separated from the company network, restored on a schedule to prove they work
GDPR and data protection Processing register, AVV contracts and safeguards aligned with GDPR and Austria's DSG Security policies and documentation Written house rules you can hand to an auditor or use for NIS2 groundwork Security solution roll-out We pick the product, install it and tune the rule set Infrastructure security Network zones, a cleaned-up rulebase and servers with nothing needlessly exposed Application security Reviewed code and deployments that stay free of new gaps Data loss prevention (DLP) Keeps sensitive files from leaving via mail attachments, flash drives or file shares Database security Tight rights, encrypted tables and an audit trail of every query Web application firewall (WAF) Bad traffic and bots stopped before reaching your site, Shopware store or API Access control and endpoint protection MFA, Intune policies and laptops you control centrally VPN and encryption Safe tunnels for home working and BitLocker on every notebook Vulnerability scans Regular scanning with fixes prioritised by severity Antivirus and EDR Malicious activity spotted, the compromised device quarantined immediately SOC monitoring Every alert reviewed by a human, clear-cut attacks contained automatically at night too System hardening Factory defaults locked down using CIS benchmarks and BSI recommendations Safe use of AI Ground rules for what may be typed into Copilot or ChatGPT
Websites and web applications 14 services spanning one-page sites to B2B portals, with SEO, care plans and post-hack repair E-commerce and integrations Webshop wired up to BMD or RZL, Amazon, eps and Austrian Post Custom software Line-of-business tools, apps and APIs that follow your processes, not the other way round Software testing and QA Defects and slowdowns caught while they are still cheap to fix
Artificial intelligenceNew Practical AI work, from spotting the right opportunity to staff training under the AI Act Data and analytics Tidy master records, a single reporting base and invoices read in automatically IT advisory and audit A second opinion on your IT plans and on how the pieces connect Online marketing Leads followed from the ad click to the signed offer, tracked in a CRM
Software and licensing Official subscriptions for IDEs, monitoring suites and sysadmin tools Training Instructor-led online sessions for teams or individuals
No idea which step comes first? We review your setup over a remote session and email you a prioritised action list Request a review
Browse all 13 solutions
NIS2 readiness Check whether you fall in scope, then set up risk handling, incident reporting and proof GDPR compliance Paperwork and technical controls in order well before the DSB comes knocking Remote and hybrid work Employees reach files and programs safely wherever they happen to be working Downtime prevention Proven backups, monitoring and an emergency playbook prepared in advance
Retail and e-commerce Shopware or WooCommerce joined up with marketplaces, eps and couriers Manufacturing ERP, servers and plant network monitored so the shop floor keeps running Medical practices and healthcare Ordination software, ELGA and e-card stable, with health data locked down Construction Plans, BIM files and AVA data synced to tablets on site Logistics and transport WMS, carrier links and dispatch that survives an outage
Small businesses A well-run Microsoft 365 and help on hand, no IT hire needed Mid-sized companies Infrastructure and security under a signed service agreement Large enterprises Assigned engineers, fast reaction and reporting to your CIO Multi-site companies Identical IT at every branch, administered from one place
Your case looks different? Describe it in a few lines, and we assemble only the pieces that matter to you Send an enquiry
About us The people behind Apply and our remote-only way of working Payment Invoices, electronic formats and due dates Contact Mailboxes, our web form, plus Teams or Meet calls
Service · IT security

Web application firewall (WAF)

An online shop is open around the clock, and not only to shoppers. A large share of traffic on a typical store comes from automated programs: bots scraping prices, scripts trying stolen credentials against the login page, scanners hunting for an outdated WordPress plugin or a known Magento flaw. Add the peaks just before Christmas or during a sale, which cannot always be told apart from an attack. A web application firewall sits in front of the application, inspects every request and lets through only what looks like a real visit. It is no substitute for updates, but it buys you time when a new vulnerability goes public and takes the bot load off your server. We set up the WAF, whether as a service from a provider such as Cloudflare, as a feature of your hosting, or as a module on the web server itself, and tune the rules so that checkout, eps bank transfers and the payment provider callback keep working.

Send an enquiry Inclusions overview
In front of the server
attacks stop before reaching the application
Bot defence
for login, basket and search
Virtual patching
when a new flaw is published
No migration
the shop stays with your host

Everything this covers

A WAF is only as good as its tuning. The stock rules are a start; the real work is fitting them to your application.

Settle the details with an engineer

Choice and set-up

A cloud WAF in front of the domain, the WAF offered by your host, or ModSecurity with the OWASP rule set on your own server. We recommend what suits your architecture and budget and switch over the DNS records.

Core rules

Protection against common web attacks such as SQL injection, cross-site scripting and file inclusion, tailored to the platform in use, be it Shopware, WooCommerce, Magento or custom code.

Bot management

Request limits per address on login, password reset and the voucher field, detection of automated clients, and challenges for suspicious visitors instead of an outright ban.

Exceptions for partners

Payment providers, shipping software, marketplace feeds and the ERP all call in via APIs. These calls are explicitly allowed so orders and status updates do not get stuck in the filter.

Geographic rules

If you only ship within the DACH region, the admin area can be limited to access from Austria and selected countries, while the shop front stays open to all.

Reporting

A monthly look at blocked requests, false positives and trends, and a focused review of rules and capacity before any big promotion.

Our working method

The WAF first watches and only then protects, so you never lose an order to a false alarm.

01

Analysis

Platform, hosting, integrations and traffic patterns. We go through access logs to estimate how much of your traffic is bots.

02

Logging mode

The WAF runs in front of the shop but does not yet decide. For one or two weeks we record what it would have blocked.

03

Tuning and enforcement

Exceptions for legitimate traffic, then a switch to blocking. The checkout is tested with every payment method.

04

Operation

Monitoring, adjustments when plugins or integrations change, and quick extra rules when a new flaw in your platform becomes known.

A WAF that locks out paying customers costs more than any bot. Overly strict rules have a habit of blocking precisely the payment provider callback that marks an order as paid. That is why, after every rule change, we run through a full purchase with card, eps, PayPal and pay-by-invoice.

Frequently asked questions

Many hosts offer network-level protection against flooding, but no rules tuned to your application. Ask what exactly is included. Often a cloud WAF placed in front is the simplest addition and the shop does not have to move.

Cloud WAFs from large providers usually absorb flooding well because they spread the load across their own network. A WAF on your own server hardly helps, since the line is already saturated before any rule can act.

No. It bridges the gap between a flaw being published and the update being installed, and it catches automated attacks. Outdated software stays a risk that only updates remove.

That varies widely by provider and scope: prices currently tend to range from a few euros to a few hundred euros a month, and we check the latest terms with the provider. On top comes the effort for set-up and upkeep, billed at €110 per hour plus VAT or as part of a service plan.

Related work in the same area

Open the full area page
Service GDPR and data protection Data map, permissions, audit logs and a plan for the first 72 hours Service Security policies and documentation A policy, a risk assessment and procedures that people actually follow Service Security solution roll-out Choosing, piloting and deploying tools remotely Service Infrastructure security Perimeter, network segments and safe remote access

Rein in the bots before your next sale

Tell us your platform, hosting and payment methods. We will suggest the right WAF approach and the best moment to put it in place.

Availability
Monday to Friday, 8:00-17:00 Austrian time (CET/CEST), reply within one working day
Meetings
By video on Microsoft Teams or Google Meet

We only use cookies that are technically required: to run the website and to remember the location you picked. There are no advertising or tracking cookies. Details are in the privacy notice.