Businesses Private clients
Remote support Help
Payment options for businesses Transfer via SWIFT, or pay by card Is this invoice genuine? PDF invoices and supporting documents
Türkçe English
Send an enquiry
Services
Solutions
Pricing
Training
About Apply
Contact
Send an enquiry
80 services in 18 areas: open the full list
Managed IT services A contracted team takes over day-to-day IT so your staff can stick to their real jobs End-to-end IT support Laptops, email and servers handled by a single provider for a predictable monthly bill IT helpdesk When someone gets stuck, they reach an engineer within minutes rather than hours Service desk Each ticket gets a number, an owner and a deadline, with a month-end tally of what was closed 24/7 support A server that fails at 3 a.m. does not have to wait for office hours Start, Business and Premium plans Pricing that starts at €490 a month plus VAT
Service plans and SLAs Guaranteed reaction times of four hours, one hour or a quarter of an hour, set in the contract System administration Regular care for Active Directory, Entra ID, virtual machines and patching IT infrastructure We measure what is ageing or slowing you down and draw up a roadmap Network and telephony An X-ray of the office network, constant monitoring and Teams Phone in place of a PBX Cloud and hostingNew VPS, dedicated servers and object storage on Hetzner, OVHcloud or Azure Backup and recovery Copies ransomware cannot wipe, plus a monthly restore drill
KVKK and personal data protection Inventory, privacy notices, processor agreements and VERBİS preparation Security policies and documentation Password, backup and access rules put in writing and signed off by staff Security tooling roll-out EDR, mail filtering or MFA: selection, deployment and fine-tuning Infrastructure security A network where guest Wi-Fi can never reach the accounting server Application security Flaws in your own code caught before they go live Data leak prevention (DLP) Customer lists and payroll sheets cannot quietly walk out of the company Database security A record of who opened which table and when Web application firewall (WAF) Bot floods and SQL injection stopped before they reach your shop Access control and endpoint security A lost laptop can be locked remotely, and every sign-in needs a second factor VPN and encryption Encrypted access to the company network from home, a hotel or a building site Vulnerability scanning Spot your exposed weak points before an attacker does Antivirus and EDR Behaviour-based detection for the attacks classic antivirus misses SOC monitoring Analysts watching logs day and night and stepping in when a threat is real System hardening Every unnecessary door closed on Windows and Linux servers Safe use of AI Clear rules in place before anyone pastes customer data into ChatGPT
Websites and web applications Fourteen services, from a brochure site to a B2B dealer portal, SEO and upkeep included E-commerce and integrations Trendyol, iyzico, Yurtiçi Kargo and your accounting package all see the same stock and orders Custom software Processes that live in spreadsheets turned into a proper application Software testing and QA Let us find the bugs before your customers do
Artificial intelligenceNew AI projects tied to a real business problem, not experiments for their own sake Data and analytics One data warehouse and reports you can trust instead of scattered spreadsheets IT consulting and audit An impartial second opinion before a big IT spend Digital marketing See which ads actually turn into sales
Software and licensing Licensed tools for developer and IT teams Training Online courses from Microsoft 365 basics to security awareness
No idea where to start? We run a short remote check-up, then send a written note of the five most urgent fixes Book a check-up
All 13 solutions on one page
Cybersecurity regulation readiness Risk analysis and a response plan for the Cybersecurity Law and sector rules KVKK compliance A complete KVKK file, from data inventory to the destruction policy Remote and hybrid work Secure access and managed devices for staff who log in from home Business continuity What happens when a server dies is written down and rehearsed
Retail and e-commerce Store, marketplaces, virtual POS and cargo in one flow Manufacturing ERP and shop-floor networks that keep an OSB factory running Clinics and healthcare Extra protection for patient data in practices and clinics Construction Current drawings flowing between site and office Logistics and transport Warehouse, fleet tracking and e-waybill systems kept running
Small businesses Simple, fixed-price IT for teams of 5 to 20 Mid-sized companies SLA-backed support and routine security for a growing company Large enterprises Specialists and extra capacity alongside your in-house IT team Multi-branch companies Head office and branches around Anatolia on the same standard
None of these fit? Describe your company in a few sentences and we will choose the services that apply Send an enquiry
About us Who we are and why we only work remotely Payment Invoices, bank transfers and card payments Contact Form, email or a video call
Service · Cybersecurity

Web application firewall (WAF)

Every public web application is probed by automated scanners around the clock. Consider a home textiles brand in İzmir that sells on Trendyol and also through its own WooCommerce store. Its admin login sees thousands of password guesses each night, bots grab limited-stock items into baskets and leave it there, and the server logs are full of requests hunting for a known flaw in an old plugin. During big sale periods traffic spikes, the site slows and genuine buyers stall at checkout. A web application firewall filters that traffic before it reaches the site. It stops known attack patterns, rate-limits sensitive actions such as login and checkout, and acts as a temporary shield when a new plugin vulnerability appears and the fix is not yet installed. Left on default settings, though, a WAF can just as easily block your payment provider's callback or a marketplace sync. The real work lies in tuning the rules to your site, and we do it remotely without moving your shop anywhere.

Send an enquiry See what this service covers
Ahead of the server
attacks end before the application sees them
Bot control
for login, basket and search
Virtual patching
until the plugin update is installed
No migration
your site stays with its current host

What the work covers in practice

Out-of-the-box rules are a starting point. The value comes from tuning them to the way your particular application behaves.

Agree the scope with the engineer who will do the work

Choosing the model

A cloud WAF in front of your domain, your host's built-in WAF, or ModSecurity on the server itself. The choice depends on traffic, platform and budget.

Core protection

Defences against the classic web attacks, including SQL injection, cross-site scripting and requests aimed at published plugin flaws, with rule sets tailored to WordPress, WooCommerce, OpenCart and Magento.

Bot handling

Per-address request limits on login, password reset, add-to-basket and search. Useful crawlers such as search engines and price comparison services are allowed in.

Partner allowances

Callbacks from iyzico, PayTR or your bank's virtual POS, courier integrations, marketplace feeds and accounting links are explicitly allowed so legitimate automation keeps flowing.

Location rules

If you only sell in Turkey and a few export markets, the admin area can be limited to certain countries while the storefront stays open to everyone.

Monthly check

A short review of blocked requests, false positives and trends, and a fresh look at limits and rules before every big sales event.

How we approach the job, from first call to handover

The WAF watches before it acts, so no order is lost to a false alarm.

01

Analysis

Platform, hosting, integrations and access patterns. Server logs tell us what kind of attacks already hit your site.

02

Log-only mode

The WAF sits in front of the site but blocks nothing yet. For a week or two it records what it would stop, and we review that list.

03

Tuning and enforcement

Exceptions for legitimate traffic, then a switch to blocking. Checkout, customer login and order flow are tested with realistic scenarios.

04

Operation

Monitoring, adjustments whenever a plugin or integration is added, and fast virtual patches when a critical flaw is announced.

A WAF buys time for updates; it does not replace them. Once a flaw in a popular plugin is published, automated exploitation often starts the same day. The WAF holds those requests back while you test and apply the update safely, but it is no excuse to skip the update.

Frequently asked questions

Cloud WAFs from large providers absorb most application-layer floods and usually come bundled with network-layer DDoS protection. A WAF running on your own server cannot reduce the traffic that reaches it, so for sites at real risk of floods we recommend the cloud option.

Hosted platforms take care of the infrastructure and baseline protection themselves, so adding your own WAF is usually unnecessary and sometimes unsupported. The focus there shifts to admin accounts, multi-factor sign-in and installed apps. A self-hosted WooCommerce, OpenCart or Magento store is where a WAF pays off directly.

We find the blocked request in the logs, work out why and add a targeted exception if needed. The approximate time and, if possible, the customer's IP address are enough to go on. Contract clients can report it via helpme@apply.tr.

The provider's fee depends on the plan and your traffic and is billed to you directly; a small site often manages with an entry-level plan. Our set-up and tuning work is separate, either as a fixed quote or at €55 per hour plus VAT against an estimate, and ongoing monitoring can be included in a service plan.

Neighbouring services that often go with this one

Back to the overview of this area
Service KVKK and personal data protection Map personal data, tighten who sees it, keep audit trails and rehearse the 72-hour breach window Service Security policies and documentation Written security rules that describe your real company, not a template Service Security tooling roll-out Choose, trial and deploy security tools, then switch them to enforcement Service Infrastructure security Close exposed services, divide the network into zones and secure outside access

Put a shield in front of your store

Tell us about your platform, hosting and payment and shipping integrations. We will recommend the right WAF approach.

Availability
Weekdays 09:00-18:00 Turkey time (GMT+3); an answer follows by the next working day
Calls
By video, over Microsoft Teams or Google Meet

The only cookies here are the essential ones: they keep the site running and remember the city you picked. Nothing is used for advertising or tracking. See our privacy notice for more.