You need a web application firewall. Here's why.