When securing a web environment, a single line of defense is rarely enough. Monarx provides two distinct but complementary security layers: SmartWAF and ThreatShield. While both are designed to stop attackers, they operate at different levels of the server stack and offer different types of protection.
Understanding the distinction between these two is critical for ensuring your applications are fully covered.
1. SmartWAF: The Network Layer Perimeter
SmartWAF operates at the Network Layer. It acts as a digital gatekeeper, analyzing traffic before it even reaches your web server or applications. Because it sits at the entry point of the network, it is highly effective at blocking large-scale automated attacks.
Global Traffic Control: SmartWAF manages access based on the reputation and behavior of the source IP address.
Filtering Modes:
Blacklist: Automatically blocks known malicious IPs, botnets, and repeat offenders.
Greylist: Subjects suspicious or "unverified" IPs to additional scrutiny or challenges without blocking them outright.
Whitelist: Ensures that trusted entities (like search engine crawlers or Monarx’s own cleanup services) always have a clear path to the server.
Protocol Neutral: Because it works at the network level, SmartWAF can provide protection regardless of the programming language used for the website.
⚠️ This feature is currently in Beta and under active development. Unfortunately It is not generally available to the public yet.
2. ThreatShield: The Application Layer (RASP)
ThreatShield is Monarx’s Runtime Application Self-Protection (RASP) and Application-Layer WAF. Instead of looking at network traffic, it looks at what the code is actually doing as it runs.
Deep Execution Visibility: ThreatShield monitors the execution of scripts in real-time. It can detect if a script is trying to perform a "malware-like" action, such as an unauthorized file upload or a database injection.
Language Specific: ThreatShield is specifically designed for PHP-based applications.
The Zend Module Requirement: For ThreatShield’s RASP features to function, the Monarx Protect Zend PHP Module must be enabled on the server. If the module is not active for a specific PHP version, the RASP protection cannot intercept the malicious execution.
Virtual Patching: ThreatShield can "virtually patch" vulnerabilities in popular CMS platforms like WordPress or Drupal, stopping exploits even if the site owner hasn't updated their plugins yet.
Key Differences at a Glance
Feature | SmartWAF | ThreatShield (RASP) |
Protection Layer | Network Layer | Application Layer (Runtime) |
Primary Mechanism | IP Reputation & Traffic Filtering | Code Execution Monitoring |
Language Dependency | None (Universal) | PHP Only |
Main Requirement | Monarx Agent | Monarx Protect Zend PHP Module |
Key Tools | Blacklist, Greylist, Whitelist | Anti-Malware, Hardening, Virtual Patching, Anti-Bot, Anti-Bruteforce, Anti-Spam, etc |
Best For... | Stopping bots and DDoS at the gate | Stopping exploits and web shells in real-time |
Why You Need Both
A robust security posture requires both layers working in tandem.
SmartWAF reduces the "noise" by filtering out millions of known bad actors at the perimeter, which saves server resources. ThreatShield provides the specialized, surgical protection needed to stop sophisticated attacks that manage to bypass the network layer—such as a zero-day exploit in a WordPress plugin.
By combining the universal network filtering of SmartWAF with the deep PHP-specific intelligence of ThreatShield, Monarx provides a comprehensive shield that protects your servers from the outside in and the inside out.