Apply Joomla edge security in controlled steps
The component sends plan-entitled proxy, WAF, managed bot, transport, header, and Enterprise access policies to the registered Help4 site without replacing Joomla's own permissions or update process.
Recommended rollout order
- Synchronize the site and run a managed scan.
Record the current plan, site ID, public behavior, and scan result first. - Enable full proxy only after DNS validation.
Static-only and full-proxy are separate modes. The site entitlement and DNS state determine what becomes effective. - Start WAF on Basic and Standard.
Verify public pages, Joomla login, administrator, forms, extensions, API routes, and scheduled tasks before increasing sensitivity. - Use Managed bot mode normally.
Adaptive challenge and Under attack are elevated modes for measured abusive traffic, not default settings for every visitor. - Add headers and access controls last.
Test each policy with a rollback path and preserve known administrator access.
WAF and managed bot modes
| Control | Use | Verification |
|---|---|---|
| WAF Off | Proxy without managed WAF inspection when the plan and risk decision allow it. | Confirm proxy headers and origin protection remain correct. |
| WAF Basic | Normal managed protection and virtual patches. | Test login, administrator, forms, uploads, and extension endpoints. |
| WAF Strict | Higher sensitivity after application compatibility testing. | Review blocks and false positives before fleet-wide use. |
| Managed bots | Continuous bot classification without a universal challenge. | Check good crawler and human navigation behavior. |
| Adaptive challenge | Challenge suspicious requests during elevated abuse. | Confirm normal users and required APIs remain usable. |
| Under attack | Temporary stronger friction during an active event. | Return to managed mode after the event is controlled. |
HTTPS, headers, and compression
Canonical HTTPS
Force HTTPS only after edge and origin certificates, callbacks, and canonical redirects are proven. Enable HSTS after HTTPS is stable.
Browser defenses
Use one canonical edge set for HSTS, nosniff, X-Frame-Options, and Referrer-Policy. SAMEORIGIN is the normal frame setting.
Transport optimization
HTTP/2 is requested automatically. gzip and Brotli can be toggled with a minimum response-size threshold.
Origin remains protected
These controls do not authorize direct-origin access or disable verified origin transport, WAF, or bypass prevention.
Enterprise access controls
Enterprise sites can send line-separated IP, country, ASN, user-agent, and path allow/block lists plus a default action. These are live edge policy.
- Add the narrow allow rules first.
Preserve administrator, monitoring, payment, search crawler, and required API access. - Leave the default action on Allow initially.
Add a bounded block rule and verify its exact effect. - Enable access control.
Save, then test from an allowed and a representative unlisted source. - Use default Block only for a deliberate allowlist design.
Maintain an independent recovery path before enabling it.
Run and validate a scan
- Select Run managed scan.
The component requests a site-scoped website scan; it does not upload Joomla administrator credentials. - Record the last-scan status.
A queued scan confirms acceptance, not a clean result. Review the scanner output in the client area or support workflow. - Keep Joomla current.
Edge virtual patches reduce exposure but do not replace Joomla core, extension, template, PHP, or server updates.