Firewall: why is it important for public-sector websites?
A firewall is a security measure that controls network traffic and helps protect systems from unauthorised logins, malicious requests and different types of attacks. Put simply, a firewall works as a filter between your server or website and the external internet: it allows only traffic that matches the defined rules, while blocking suspicious or dangerous requests.
For public-sector organisations – municipalities, schools, libraries, museums, arts centres and other organisations – a firewall is not an optional extra, but one of the basic cybersecurity measures. Such websites often publish public information, receive residents’ enquiries through forms, event registrations or service requests, and therefore become an attractive target for automated attacks. Even if a website seems simple, it may process personal data, so security measures are directly linked to GDPR requirements as well.
What is the difference between a network firewall and a WAF?
When talking about websites, it is important to distinguish between two main types of protection. A network-level firewall protects the server and infrastructure more broadly – it controls connections, ports, IP addresses and other technical traffic. Meanwhile, a WAF (Web Application Firewall) is specially adapted for web applications and websites.
A WAF analyses the HTTP and HTTPS requests received by the website and helps detect typical web application threats. It can block attempts to carry out SQL injections, XSS attacks, malicious login attempts, unusually high volumes of requests or other suspicious behaviour. This is especially relevant for websites that have search fields, contact forms, document downloads, user accounts or a content management system.
Why is a firewall relevant for the public sector in the EU?
Public-sector websites in the EU often have to meet not only information security requirements, but also accessibility, legal compliance and reliability requirements. If a municipality or school website becomes unavailable because of an attack, residents may be unable to find important information about services, admissions, registration or public tenders. In the case of museums and libraries, this may mean disrupted event registration, non-working catalogues or inaccessible digital content.
A firewall helps ensure service continuity and reduces the risk that the website will be breached, infected or used for malicious activity. In addition, if the website collects enquiries, requests, registrations or other data, security measures become an important part of the organisational and technical measures under GDPR. In other words, a firewall contributes not only to technical protection, but also to responsible data processing.
What threats does a firewall help control?
- Automated login attempts. Publicly accessible administration environments often become a target for bots that try to guess passwords. A firewall can limit such attempts, block suspicious IP addresses and reduce the risk of account takeover.
- Malicious requests in forms and search. If a website has contact forms, registration or a search function, attackers may try to insert malicious code. A WAF helps recognise such attempts and stop them before they reach the website’s application logic.
- Attempts to exploit website or plugin vulnerabilities. Content management systems such as WordPress depend on updates to the core, themes and plugins. A firewall does not solve the problem of outdated software, but it can reduce the risk until the vulnerability is fixed or the update is installed.
- Excess traffic and service disruption. In some cases, a website is overloaded with a large number of requests, which slows it down or makes it unavailable. A properly configured firewall can filter some of this traffic and help keep the website running.
A firewall is not the only protection
It is important to understand that even a good firewall is not a solution that fixes everything. It must work together with other measures: regular system updates, strong passwords, two-factor authentication, backups, access rights management and server monitoring. For public-sector organisations, it is especially important to have clear processes – who is responsible for updates, who reviews security notices and how incidents are handled.
It is also worth noting that security is linked to website accessibility. If security solutions are configured incorrectly, they may interfere with legitimate users, for example by blocking forms or making login more difficult. Therefore, a firewall must be deployed in a way that does not become a barrier for residents, staff or people using assistive technologies.
Firewall solutions in the WordPress environment
If a public-sector website is built using WordPress, WAF solutions such as Wordfence, Sucuri or Cloudflare are often chosen. They can filter malicious requests, limit login attempts, monitor suspicious activity and, in some cases, protect the website even before traffic reaches the server. In practice, this means less load on the server and a faster response to the most common threats.
However, simply installing a plugin is not enough. It is necessary to make sure the solution is properly configured, updated and compatible with caching, CDN, login and form behaviour. In public-sector websites, it is especially important to test whether service request forms, document submission, event registration and other functions important to residents still work after security changes.
What should be planned when deploying a firewall?
- Clear rules and responsibilities. It should be clear who administers the firewall, who reviews alerts and who makes decisions about blocking rules. This is especially important in municipalities and larger organisations where the website is maintained by several staff members or an external provider.
- Regular monitoring. A firewall generates logs and alerts, but they are only useful when they are reviewed. Periodic review helps identify repeated attempts to attack the website and take additional measures in time.
- Compatibility with GDPR and internal processes. If a security solution collects technical data, such as IP addresses or incident logs, it is important to assess the legal basis for processing, storage periods and access control. This helps ensure that security measures are not only effective, but also managed lawfully.
Summary
A firewall is an essential part of website protection, helping filter traffic, block malicious requests and reduce the risk of security incidents. For public-sector organisations it is especially important because of service continuity, residents’ trust and responsible data processing. The best results are achieved when network-level protection and a WAF are used together, and all of this is combined with updates, backups, access control and clear administration processes.
Worried about your website’s security? Tobalt develops protected public-sector websites and ensures their security, firewall and protection against attacks.