Web Application Firewalls (WAF) sit in front of your app and block SQL injection, XSS, and known-bad IPs. Cloudflare, Sucuri, and AWS WAF are common options. For law firm sites handling client PII, a WAF plus rate limiting on login endpoints is table stakes.
Firewall
Also known as: WAF