Defense in depth: what to expect
Defense in depth means layering several complementary protections so a single failure doesn’t lead to a full compromise. Typical layers for an e‑commerce site are:
-
Network firewall: blocks unwanted traffic, port scans and volumetric attacks.
-
Web Application Firewall (WAF): inspects HTTP(S) requests and filters injection, XSS, LFI, and similar application attacks.
-
Two‑Factor Authentication (2FA): reduces risk of unauthorized admin access even if passwords are leaked.
Know the limits: a network firewall won't stop sophisticated application‑level payloads. A WAF can be bypassed if misconfigured or if rules are too permissive. 2FA secures logins but doesn’t prevent server‑side vulnerabilities. Use them together.
Deployment order
-
Backups & inventory: create full backups and list CMS/plugins/modules and versions.
-
Updates: apply critical updates (CMS, plugins, PHP) before adding protections.
-
Network firewall: implement basic rules (restrict public SSH, rate limits, anti‑DDoS where possible).
-
WAF: start in monitoring (learning) mode, then switch to blocking after tuning.
-
2FA: enable for admin and sensitive accounts.
-
Monitoring: set up logging and alerts, and schedule regular checks.
Platform‑specific defensive examples
-
WordPress/WooCommerce: use a WAF with OWASP rules, IP blacklisting and protection against brute force. Enforce 2FA for administrators (TOTP apps or hardware keys). Restrict /wp‑admin access by IP where viable.
-
PrestaShop 1.7+: protect the back office paths, harden file permissions, and apply WAF rules that cover POST/GET validation. Require 2FA for employees with back office access.
-
WooCommerce: protect payment and REST API endpoints with WAF rules, employ bot mitigation at the network firewall level, and monitor order/payment anomalies.
Common mistakes to avoid
-
Enabling WAF in blocking mode immediately: causes false positives that hurt customers.
-
Poor 2FA recovery planning: ensure secure backup codes or alternate methods.
-
Treating WAF as a substitute for updates: patching remains essential.
-
Overprivileged accounts: avoid using admin accounts for daily tasks.
Tests after activation
-
Observe WAF logs for 48–72 hours and fine‑tune rules.
-
Verify 2FA works for targeted users and recovery methods are functional.
-
Run non‑destructive web application scans to find remaining issues.
-
Check availability and performance to ensure protections don't cause errors or undue latency.
Practical checklist
-
Full backups and tested restore procedure
-
Up‑to‑date CMS, themes, plugins, PHP
-
Network firewall: SSH restricted, rate limiting
-
WAF: monitoring then blocking, OWASP rule set
-
2FA for admin accounts, secure recovery methods
-
Least privilege for users and services
-
Centralized logs and alerts
-
Incident response plan and professional contacts
Conclusion
Network firewalls, WAFs and 2FA together create a practical defense‑in‑depth for WordPress, WooCommerce and PrestaShop. Prioritize backups, updates and monitoring, and tune protections gradually. Consider professional help for complex environments or incidents.
