Businesses Private clients
Get remote help Help
How companies settle invoices SWIFT bank transfer or card Checking that an invoice really came from Apply PDF invoices and related paperwork
Slovenščina English
Send an enquiry
Services
Solutions
Pricing
Courses
Articles
About Apply
Contact
Send an enquiry
Browse the catalogue: 80 services in 18 areas
Managed IT support Hand routine IT chores to a remote team and keep your people focused on clients End-to-end IT support One contract and one predictable bill for laptops, servers and Microsoft 365 IT helpdesk Stuck colleagues reach a technician in minutes, not the next morning Service desk Tracked tickets with clear owners, deadlines and a monthly recap 24/7 support Overnight and weekend cover for businesses where downtime is not an option Plans: Start, Business, Premium Prices start at €450 monthly plus VAT, response targets fixed by contract
Service plans and SLAs Pick a 4-hour, 1-hour or 15-minute response and get monthly proof we hit it System administration Patching, identities and servers handled to a timetable, fully documented IT infrastructure Find out what is really holding you back before spending on new hardware Network and telephony Network audits, continuous monitoring and phone calls moved onto Teams Cloud and hostingNew Virtual, dedicated and storage capacity in EU data centres such as Hetzner or OVHcloud Backup and recovery Immutable copies beyond the reach of ransomware, with restore drills on the calendar
GDPR and data protection The paperwork a Slovenian controller needs, from processing records to processor contracts Security policies and documentation Short, readable rules your staff sign and genuinely stick to Security tooling roll-out Selection, deployment and tuning of EDR, mail filters and MFA Infrastructure security Visitors on guest Wi-Fi kept well apart from the finance server Application security Catch weaknesses in in-house code before release day Data leak prevention (DLP) Payroll spreadsheets and client databases stay where they belong Database security Every query against sensitive tables leaves a trace Web application firewall (WAF) Bots and SQL injection filtered out before they touch your checkout Access control and endpoint security Remote lock for mislaid laptops and MFA on every account VPN and encryption Secure connections to company systems whether at home, in a hotel or on a construction site Vulnerability scanning See your exposed weak spots first, ahead of any intruder Antivirus and EDR Behavioural detection catches what signature scanning misses SOC monitoring Round-the-clock log review, with action taken on genuine threats System hardening Unneeded ports and services closed on every Windows and Linux host Safe use of AI Agreed ground rules before client data ends up in ChatGPT or similar tools
Websites and web applications Brochure sites, shops, portals, SEO and upkeep: fourteen services in one area E-commerce and integrations Shop, Amazon, Minimax, Stripe and GLS working from shared stock and order data Custom software Move workflows out of spreadsheets into an application built for them Software testing and QA Bugs caught in testing, not by your buyers
Artificial intelligenceNew Practical AI projects aimed at a measurable business need Data and analytics A single warehouse and consistent figures instead of spreadsheet sprawl IT consulting and audit Impartial advice before you commit budget to a major IT project Digital marketing Find out which campaigns actually pay off
Software and licensing Genuine licences for dev and IT teams, with renewals tracked for you Training Live courses over video, from Microsoft 365 essentials to spotting phishing
Unsure what to tackle first? A brief remote check-up ends with a written list of five priorities Request a review
See all 13 solutions together
NIS2 readiness Risk assessment, incident planning and supplier security for NIS2 and ZInfV-1 GDPR compliance Processing records through to a breach procedure, delivered as a set Remote and hybrid work Protected access and managed laptops for staff outside the office Business continuity A rehearsed plan for the day a key server goes down
Retail and e-commerce Web shop, marketplaces, payments and couriers connected end to end Manufacturing ERP and plant network kept running across every shift Clinics and healthcare Stronger safeguards around patient records in surgeries and private practices Construction Office and site crews working from one current set of drawings Logistics and transport WMS, e-CMR and vehicle tracking available whenever the trucks roll
Small businesses Simple IT at a known monthly price for teams of five to twenty Mid-sized companies Support under an SLA plus regular security work as headcount grows Large enterprises Extra hands and niche expertise to back up your internal IT department Multi-site companies Headquarters and every branch in Slovenia on one IT standard
No match for your situation? Tell us about the company in a couple of lines and we will suggest the right services Ask for advice
Who we are The people behind Apply and why we work only remotely Articles Practical pieces about IT and security Paying us Invoices, SWIFT transfers or payment by card Contact Write via the form or by email, or book a video call
Service · Cybersecurity

Web application firewall (WAF)

Put anything on the web and automated scanners will be knocking within hours, day and night. Picture a Celje business selling baby products through a self-run WooCommerce site and listing on Ceneje.si. Overnight, its admin page absorbs thousands of credential-stuffing attempts. When a limited promotion launches, scripts snap up stock and abandon it in baskets. Server logs scroll with probes for a known hole in an ageing plugin. Then, in the pre-Christmas rush, pages crawl and paying customers give up at the checkout. A WAF strains out this junk upstream of the server: recognised attack signatures are dropped, login and payment endpoints are throttled, and a freshly disclosed vulnerability can be shielded while you prepare the patch. The catch is that an untuned filter is equally capable of rejecting the payment provider's confirmation or a marketplace update. Fitting the rules to your site is where the effort goes, done remotely with no change of host.

Ask about this service See the scope
Upstream filtering
malicious requests never touch the application
Bot throttling
on login, basket and search pages
Virtual patch
covers a newly disclosed hole until you update
Same host
nothing is migrated

Scope of the service

Vendor rule packs give a head start; tailoring them to your site is where the protection really comes from.

Check the scope with an engineer

Picking the model

A cloud service sitting ahead of your domain, Cloudflare for example, the WAF your hosting company offers, or ModSecurity running on the server. Traffic levels, platform and budget decide.

Baseline protection

Coverage for injection attacks, XSS and scans for well-known plugin bugs, with dedicated rule packs for WordPress, WooCommerce, PrestaShop and Magento.

Handling bots

Request ceilings per visitor on sign-in, password reset, basket and search. Search engine crawlers and price comparison robots keep their access.

Allow-lists for partners

Payment notifications from Stripe, PayPal or Bankart, plus syncs with couriers, marketplaces and accounting, are explicitly permitted so orders keep flowing.

Geographic limits

If your customers are mostly in Slovenia and nearby markets, admin access can be fenced to those countries while shoppers anywhere still reach the catalogue.

Monthly look-back

Blocked traffic, false alarms and emerging patterns, summarised briefly. Ahead of Black Friday or the Christmas season we revisit thresholds.

How the work runs

Observation comes before enforcement, so no genuine order is ever lost to a misfire.

01

Assessment

Platform, host, integrations and normal traffic shape, plus a read of server logs to see what is attacking you right now.

02

Shadow mode

Filtering is switched on in record-only mode. For one to two weeks we study what it would have blocked.

03

Calibration and enforcement

Legitimate flows are allow-listed, blocking is enabled, and checkout, sign-in and ordering are walked through with realistic test cases.

04

Running it

Ongoing monitoring, rule changes when plugins or integrations are added, and quick virtual patches when a serious flaw goes public.

A WAF is not a substitute for patching; it gives you breathing space to patch. Exploits for a popular plugin can appear within hours of disclosure. While the WAF holds them off, you can test the fix calmly and deploy it. Skipping the update because “the WAF will handle it” is never the answer.

Your questions answered

Cloud WAFs from major providers soak up a lot of application-level flooding and generally include network-level DDoS mitigation. Software filtering on the web server itself cannot reduce load that has already reached it. For higher-risk sites we suggest the cloud route.

Hosted platforms handle infrastructure and base protection themselves, so an extra WAF is rarely necessary and may not even be possible. Attention moves to admin accounts, second-factor sign-in and the apps you install. Self-hosted WooCommerce, PrestaShop or Magento stores gain the most from a WAF.

We look up the blocked request, see which rule fired and add a precise exception where appropriate. Give us an approximate time and, if possible, their IP. Clients with a contract simply email helpme@apply.si.

The WAF provider charges you directly according to plan and traffic, and smaller sites often manage on an entry tier. Our configuration work is separate, either €50 per hour plus VAT within an estimate or a fixed price, and continuous monitoring can sit inside a service plan.

More services in this area

Open the area page
Service GDPR and data protection Processing records, processor contracts, safeguards and a ready plan for when a breach happens Service Security policies and documentation A policy, risk register and procedures that match daily reality Service Security tooling roll-out Choosing, trialling and deploying protection remotely Service Infrastructure security Perimeter clean-up, network zoning and controlled outside access

Shield your shop from bots and exploits

Tell us what your shop runs on, who hosts it and which payment and shipping services it talks to, and we will propose a fitting set-up.

When we work
Weekdays 9:00-17:00 CET, answers the same or next working day
Calls
Video meetings, Teams and Meet both welcome

We set essential cookies only: the ones that keep the site running and recall which town you chose. Nothing for ads and nothing that follows you around the web. Details are in our privacy and data protection notice.