Use Sucuri or GoDaddy WAF bypass-prevention rules on Apache safely: back up .htaccess, use current vendor rules, verify WordPress, forms, cache, and logs.