Security Defense Layers - Edge & Server Playbook

Purpose

• Minimize attack surface at the perimeter and web server before application code runs
• Default-deny invalid or abusive traffic, and log for investigation

Defense layers

Edge perimeter filtering

• Block traffic by country or region to reduce bot and scanner traffic before it reaches the site

IP and domain restrictions

• Block suspicious IP addresses and ranges
• Restrict domain traffic at the web server
• Use allow-lists where needed
• Use dynamic restrictions for abusive sources

Web-server request filtering

• Block disallowed HTTP verbs
• Block disallowed file extensions
• Block suspicious URL sequences
• Stop bad requests before application code runs

Bot and crawler blocking

• Block known bad bots via User-Agent pattern rules at the web server level

Security headers

• Enable HSTS - HTTPS-only, include subdomains, preload
• Disable MIME sniffing
• Restrict framing to same-origin
• Set a conservative referrer policy
• Enable a legacy XSS filter only if required for back-compat