this is going to read like a rant against firewalls and it isnt, we still run one. its a rant about the shape of the conversation.
client got scared after a competitor got ransomwared and asked me what to buy. i pointed at a managed cybersecurity firewall in front of their little cluster, four figures a year, plus the time to tune it. we did it. most of a year later i went back through every incident we had logged on their stuff, and here is what took the site down or broke something in that window:
1- a php version bump on the host that broke an old payment plugin. nobody attacked anything. thirty minutes of checkout returning a white sceen at 8am
2- an expired card on the dns provider. the account went into grace, then the zone stopped answering, and that is the worst outage they have ever had
3- a disk that filled with a debug log i left switched on after a fix in the autumn. mysql stopped writing and the site half worked for hours
4- a plugin auto update that changed a template file and took the header off on mobile only
5- one real attack, a credential stuffing run against wp-login, which the firewall did catch and which the rate limit already sitting there would also have caught
the thing we bought did its job exactly once. the other four came out of billing, versions and my own sloppiness, and none of those have a product you can buy. they need somebody to look at a list once a week and care about what is on it.
im not saying skip the firewall. a wordpress site with a public login form gets hammered constantly and you want something in front of it. what i am saying is that the money and the attention go to the scary thing while the boring things are what cost the client hours. i had the same instinct, buying the box felt like doing something and writing a monitoring cron did not.
the second bit that bugs me is what a firewall does to your debugging. every weird intermittent problem has a suspect now. we spent an afternoon convinced a rule was eating a partner's api calls and it was dns caching on their end. before we had one, that afternoon would have gone to the real cause faster.
what do you lot spend on prevention against what you spend on knowing when something broke? the ratio at most places i see looks backwards to me.
Source: r/WebsiteHealth · by /u/anouk_98