I put a WAF on the front door. The spam wasn't using the front door.

There's a small corporate site. A few days after launch, one piece of spam landed in the contact form. Zero actual damage. Just a lazy ad. But there were two real problems. One: no spam protection at ...