Layer edge security around Drupal without hiding application risk
Help4 CDN supplies plan-entitled WAF, virtual patching, managed bot, transport, header, access, and scan controls. Drupal core, module, theme, PHP, database, and server maintenance remain required.
Safe rollout sequence
- Synchronize and scan.
Record the site ID, plan, current public headers, Drupal status report, and scan request before changing policy. - Prove full proxy and DNS first.
Do not assume a selected local mode is active until public responses show the intended Help4 route and origin protections. - Start WAF Basic at Standard sensitivity.
Test public nodes, search, JSON:API/REST routes in use, forms, login, administration, cron, file delivery, and payment or SSO callbacks. - Use Managed bots as the normal mode.
Elevate to adaptive challenge or Under attack only during measured abusive traffic. - Roll out headers and access controls individually.
Verify each change and keep a non-edge recovery path.
WAF and bot controls
| Mode | Purpose | Application check |
|---|---|---|
| Off | Proxy without managed WAF inspection when explicitly intended. | Origin guard and private cache behavior still hold. |
| Basic | Normal managed rules and virtual patches. | Drupal forms, APIs, administration, login, uploads, and callbacks pass. |
| Strict | Higher request scrutiny after compatibility testing. | False-positive review is available before broad use. |
| Managed bots | Continuous bot handling without universal visitor friction. | Good crawlers and normal humans remain functional. |
| Adaptive challenge | Challenge suspicious browser traffic. | Required APIs and non-browser clients are excluded deliberately. |
| Under attack | Temporary high-friction response to an active event. | Return to managed mode when the event resolves. |
HTTPS, headers, and transport
Force HTTPS
Enable only after edge/origin TLS, canonical redirects, Drupal trusted-host settings, proxies, callbacks, and absolute URLs are verified.
HSTS
Start without subdomain/preload commitments. Increase max age only after every required hostname remains valid over HTTPS.
Canonical headers
Use one edge set for nosniff, X-Frame-Options, Referrer-Policy, and the managed cross-origin defaults.
Compression
HTTP/2 remains enabled in auto transport mode; gzip and Brotli use the configured minimum response threshold.
Enterprise access controls
The module can send IP, country, ASN, user-agent, and path allow/block lists with an explicit default action. The control is protected by Drupal's dedicated permission and Form API CSRF handling, but a valid administrator can still lock out the site with a bad rule.
- Add administrator and monitoring allow rules first.
- Keep default Allow while testing bounded block entries.
- Verify from an allowed and representative unlisted source.
- Use default Block only for a deliberate allowlist architecture with recovery access.
Scan and patch responsibly
- Select Run managed website scan.
The module sends the registered Help4 site identity and a scan reason, not Drupal administrator credentials. - Treat queued as accepted, not clean.
Review the resulting site-scoped scanner findings through the client or support workflow. - Maintain Drupal security releases.
Edge virtual patches add time and reduce exposure; they do not replace vendor updates or configuration review.