I hardened a live SaaS platform by tuning a CDN and WAF without slowing real users. I share the constraints, my steps, and quick checks you can apply now.
Case study
I tuned a content delivery network and a web application firewall on a live SaaS platform to improve safety without slowing users. A content delivery network, or CDN, stores files closer to users, and a web application firewall, or WAF, blocks malicious requests.
The industry and problem
The platform served clinics and nonprofit operators that handle sensitive account data. Automated attacks probed login and data routes while customers worked in the app throughout the day.
Constraints
No downtime was acceptable, so changes had to ship in small steps with quick rollback. Web and mobile apps shared the same API, the application programming interface. ADA accessibility and HIPAA readiness mattered, and protected data could not persist at the edge; confirm specifics with your attorney or compliance advisor.
My approach
- Mapped each endpoint by authentication, method, and cache policy, then set Cache-Control headers so static assets cache and sensitive or authenticated routes do not.
- Started the WAF in log only, enabled core rules, reviewed alerts, and suppressed clear false positives.
- Added per IP address rate limits to login, password reset, and token routes, and used non-interactive checks that did not break screen readers.
- Rejected invalid content types, oversized bodies where not needed, and suspicious query strings.
- Improved CDN behavior with versioned asset filenames, compression, and stale-while-revalidate, and bypassed cache for APIs and any page with user data.
- Locked down the origin server to CDN only and set security headers to protect cookies and require encryption.
What I learned
Protect flows, not pages, and ship small changes with real monitoring. Keep a support bypass, and put rule review on a calendar so protections stay aligned with the app.
Try this week
- List your login, reset, and token endpoints, then add a simple per IP address rate limit to each.
- Turn your WAF to log only for a short window, read the top triggers, then suppress clear false positives.
- Set Cache-Control: no-store on authenticated pages and APIs, and use versioned filenames for static assets.
- Test key pages with only a keyboard and a screen reader to confirm challenges do not block access.
How I can help
I tune protections under Security & Compliance > WAF & Firewall, review Security & Compliance > ADA Accessibility, and help with Security & Compliance > HIPAA Compliance. For training and measurement, I offer Training & Education > AI Training and AppWT Analytics.
Get the next one in your inbox
Pick your topics and how often, from weekly to quarterly. I send a confirmation email first, and you can change or stop it any time.
Get more like this by emailMore in Security & Compliance
Two-pass verification on a SaaS
I show how I added a second check to a SaaS for risky actions and give steps to add it to yours.
Encrypt data at rest and in transit
I show how to enable storage encryption and TLS, and what to verify at the end.
Firewall change management
I share a practical firewall change management checklist with approvals, testing, and rollback steps you can use this week.
Business Associate Agreement basics
I explain what a Business Associate Agreement is, when you need one, and how to put it in place.
