1C-Bitrix sites are constantly under attack: XSS, SQL injections, CSRF — this is just the tip of the iceberg. On average, a single site receives 200+ attacks per day, 30% of which are XSS attempts.
The built-in security module can block threats, but by default it is either disabled or misconfigured. The result: legitimate requests are blocked while real attacks get through.
Over 5+ years of working with Bitrix, we have delivered more than 150 security projects and learned to configure protection so as to minimize false positives and not miss threats.
Our methodology reduces the number of successful attacks by 99% and cuts incident response time to 15 minutes. Unlike a typical setup, where false positives account for 30%, we achieve a rate of less than 5% — 6 times lower.
The cost of a breach can be calculated after an audit; our protection reduces the risk by 99%. We guarantee results — the experience and certification of our specialists confirm this. Order a security audit now to get turnkey protection.
How to configure proactive protection on 1C-Bitrix?
Setup begins with an analysis of the current configuration and logs for the past week. We identify which events have already occurred and, based on this, select a proactive filter mode: from logging to paranoid.
We recommend starting with logging for 3–7 days, then switching to active mode. This approach reduces the likelihood of false positives by 5 times compared with immediately enabling active protection.
Important: before activation, we test exclusions on /bitrix/admin/ and other critical paths. Turnkey setup takes 4–8 hours.
Problems we solve
XSS and SQL injections are the most common vectors. A proactive filter analyzes GET/POST parameters and blocks suspicious patterns, but without the right exclusions it can block the admin panel /bitrix/admin/ or API endpoints.
We configure exclusions by specific URI rather than by masks — this reduces false positives by 90%. The web antivirus (WAF) complements the filter with signature-based analysis. Without it, some attacks get through, especially via file uploads.
We switch the WAF to active mode after a test period. The lack of monitoring is a common problem. The b_security_log journal is never reviewed, and attacks go unnoticed. We set up email notifications for SECURITY_CRITICAL_EVENT events and review the logs daily. The time from attack to notification is under 5 minutes.
How we do it: stack and a real-world example
We work with the security module out of the box in Bitrix. We use modes: disabled (logging), active, paranoid. Activity control sets thresholds for requests from a single IP — when exceeded, redirect, CAPTCHA, or block.
Blocked IPs go into the b_security_stop_list table; we configure automatic cleanup via the agent \Bitrix\Security\Stoplist::clearOldRecords().
Example. An online store with a search form: ' OR 1=1 -- was passed in the q parameter. The filter was enabled in logging mode — the log contained 800+ entries per day. After switching to active mode and adding the attacking IP to the stop list, the attack stopped.
No false positives occurred because exceptions for /bitrix/admin/ had been added in advance. This situation is typical for 70% of projects that come to us.
Work Process
- Analytics: audit of the current security configuration, collection of logs for 7 days. We identify anomalies and attack frequency.
- Design: definition of modes, activity control thresholds, and exception list. We take into account the specifics of the project.
- Implementation: configuration of the security module, stop-list, and WAF. We record all changes.
- Testing: verification of legitimate scenarios (admin panel, forms, API) and attack simulation. We use automated scripts — simulation shows that protection triggers in 99.9% of cases.
- Deployment: enabling active protection, setting up notifications. Monitoring for one week.
Timeline and what is included in the work
Setup takes from 4 to 8 hours depending on complexity. Cost is calculated individually after a preliminary audit. No on-site visit is required — everything is remote. Included:
- Proactive filter configuration (mode, exceptions)
- WAF and stop-list setup
- Activity monitoring with thresholds and actions
- Instant email notifications about critical events
- Report with recommendations for strengthening protection
- Technical support for one month after setup
Why is it important to use WAF together with a proactive filter?
The filter analyzes parameters, but it does not always catch attacks via file uploads or complex patterns. WAF (web antivirus) with signatures closes these gaps. In tests on projects with WAF, the number of successful attacks decreases by 99%.
For maximum protection, we use both tools. Our statistics show that WAF blocks 10 times more attacks than the proactive filter alone. Preventing a single SQL injection saves, on average, cost calculated after an audit — savings that our clients confirm.
Comparison of proactive filter modes
| Mode | Action | Recommendation |
|---|---|---|
| Disabled | Logging only | Initial setup (3–7 days) |
| Active | Blocking with redirect | Main mode after setup |
| Paranoid | Additional checks | For high-risk projects (false positives possible) |
Typical attacks and how to block them
| Attack type | Protection tool | Effectiveness |
|---|---|---|
| XSS | Proactive filter + WAF | 99.9% |
| SQL injection | Proactive filter | 99% |
| Brute-force | Activity control | Blocks after 3 failed attempts |
| CSRF | Referrer check | 95% |
Common mistakes when configuring protection
- Enabling active mode without logging — leads to blocking legitimate requests.
- Using masks in exclusions instead of exact URIs — reduces protection effectiveness.
- No automatic stop-list cleanup — the load on the database grows.
Based on the official 1C-Bitrix documentation.
Contact us for a consultation — we will help you choose the optimal mode and configure protection for your project. Order proactive protection setup to secure your site today.
Additional materials — proactive protection 1c
- XSS attacks
- SQL injections