Security overview
TurboStack defends your servers and applications with layered protection that works automatically. This page explains what each layer does in plain language. For the settings you can adjust yourself, see Security configuration.
Note
Each host has a Threat Center tab that surfaces the security findings detected on that host (see TurboRadar below).
Web traffic protection
TurboShield
TurboShield filters traffic to your applications and is enabled by default at the medium level. It protects your applications without blocking the visitors and search engines you want to reach.
TurboShield provides:
- Rate limiting - caps how many requests and connections a single visitor can make, so nobody can consume all your capacity.
- Bot classification - friendly limits for verified good bots (such as Google and Bing) and stricter limits or blocks for scraping and AI training crawlers.
- Search-bot verification - confirms that traffic claiming to be Googlebot or Bingbot is genuine, preventing spoofing.
- Known-exploit blocking - blocks requests matching known exploit signatures before they ever reach your application.
- Attack detection - recognizes attack behavior in your logs (injection probing, file scanning, brute-force logins) and temporarily bans the source at both the web server and the firewall. Bans always expire on their own.
- Shared reputation - blocks sources already known to be malicious on other sites.
- Bot challenge (optional) - an automatic browser check for suspicious visitors, for sites under scraping or credential-stuffing pressure.
You can choose a level to match your situation:
Trusted addresses on your allow-list skip every check. See Configure TurboShield.
Note
When a visitor exceeds a limit they receive a soft 429 response and can try again shortly. They are not banned at the firewall.
Network protection
Firewall
TurboStack runs a stateful firewall that protects your server at the network layer. It continuously watches for malicious behavior such as SSH brute-force attempts and web attacks, and automatically blocks offending IP addresses. Bans expire automatically. It applies connection rate limits, honours any IP addresses on your allow-list, and is fully managed by the platform.
Runtime and malware protection
TurboRadar
TurboRadar adds runtime security detection and scanning that runs after your application is deployed. It:
- detects suspicious process behavior such as web shells, in-memory or fileless malware, and access to credential files;
- finds known vulnerabilities (Common Vulnerabilities and Exposures, or CVEs) in your packages and containers; and
- runs commerce-specific malware scans for Magento, WooCommerce and PrestaShop.
Findings are reported to each host's Threat Center tab, where you review them, see how urgent each one is, and act on it.
Encryption and access
- Transport Layer Security (TLS) certificates - the encryption behind
https://- are issued and renewed automatically for each application using Let's Encrypt. This keeps traffic between your visitors and the server private. See Applications. - Secure Shell (SSH) access - encrypted remote access to the server - is key-based rather than password-based, which is far harder to brute-force. See SSH access.
What you should do
Most of this protection is automatic, but a few things are yours to act on:
- Review the Threat Center on each host now and then, and after any security alert. Fix anything marked Exploited (Known Exploited Vulnerabilities, KEV) or Likely exploited first.
- Keep your applications and their dependencies up to date. Most vulnerabilities are fixed simply by updating to a newer version.
- Leave the defaults on (TurboShield, the Firewall, the Web Application Firewall, or WAF) unless you have a specific reason to change them.
- Raise TurboShield to
highorattackonly while you are under abusive traffic, then return tomedium.
Defaults
Important
By default: TurboShield runs at medium, the Firewall is managed automatically, and TurboRadar is enabled on every host.