My work
Case studies
Client stories will appear here as clients agree to share them. Until then, these come from my years running hosting platforms for other organisations – anonymised, with no names – and from my own site.
Stories
The problem, what I did, the result
Hosting platform
Onto Cloudflare before the attack, with zero downtime
The problem
An attack group had said it would go after an organisation’s whole industry, and there were other signs the organisation was on the list. Its websites weren’t on Cloudflare yet.
What I did
I moved the websites onto Cloudflare before the attack came, with no outage during the move:
- A partial (CNAME) setup, so the organisation’s own DNS stayed where it was and only the website names pointed at Cloudflare.
- Every DNS record copied and checked, and certificates active on Cloudflare, before any traffic moved.
- Firewall rules in place ahead of time to cut down what an attacker could reach, and stricter rules ready to switch on the moment an attack started.
- A new IP address for the web server, in case the attackers had already recorded the old one, with the server only accepting traffic from Cloudflare.
- The old IP address handed to a honeypot, to see who still went looking for it.
The result
The move started at about 11am, and the websites were on Cloudflare by 2pm. When the attack came at around 10pm that night, the websites stayed up, with no downtime. The honeypot on the old address saw some direct traffic, but far less than was thrown at the websites through Cloudflare, and nothing tried to get around Cloudflare to the new address.
Hosting platform
A compromised account, contained in minutes
The problem
During a targeted attack campaign, an account on the platform was compromised.
What I did
I spotted it and contained it, then led the uplift that followed: MFA, least-privilege admin, endpoint protection and a web application firewall.
The result
Contained within minutes, and stronger defences across the platform afterwards.
My own site
The contact form that silently rejected customers
The problem
WebControl’s own contact form had stopped delivering messages, with no error anywhere. A Cloudflare Access app protecting /wp-admin was also blocking admin-ajax.php, which the form sends through.
What I did
I found the blocked submissions in Cloudflare’s security events (about 120 in 30 days), removed the Access app, rebuilt the WAF rule to protect the login while letting the form through, and added Turnstile and saved submissions.
The result
The form works, spam is stopped on purpose rather than by accident, and every message is kept even if email fails. The full story is on the blog.
Hosting platform
Certificates that renew themselves
The problem
A hosting platform relied on paid certificates, renewed by hand – with an expired certificate always one missed reminder away.
What I did
I moved it to automatic renewal, ahead of the industry shortening certificate lifetimes. Sites behind Cloudflare use its edge certificates, and anything that can’t be automated is watched for expiry.
The result
Renewals stopped being a job someone had to remember.
Got a problem like one of these? Tell me what’s happening, and I’ll tell you honestly what you need.
Under attack right now? Call +61 2 8363 3348.