Security

The host's Security tab is where you configure how incoming web traffic is protected. This page covers the practical configuration steps. For how the underlying protections work, see the Security overview.

This tab covers:

• TurboShield - traffic filtering, bot controls and attack detection
• IP allow-list - trusted IP addresses and ranges that bypass blocking
• GeoIP filtering - allow or block traffic by country
• Web Application Firewall - block requests matching known attack patterns
• Automatically managed protections - the firewall TurboStack manages for you

TurboShield

TurboShield protects your applications against malicious web traffic and Distributed Denial of Service (DDoS) attacks - attempts to overwhelm your site with so many requests that it goes offline. It applies rate limits, a cap on how many requests one visitor can make. It adds bot controls, which tell good automated visitors from bad ones. It also detects attack behavior and temporarily bans the source. You can enable or disable it per host and choose a protection level. For everything it does and every setting, see What is TurboShield? and Configure TurboShield.

Throttled visitors receive a soft 429 (Too Many Requests) response rather than being banned at the firewall, so legitimate traffic recovers automatically once it slows down. This matters for you because it means search engines and real customers are not locked out when traffic spikes. Bans, which only follow clear attack behavior, always expire on their own.

Level	Behavior
low	Lenient rate limits; minimal bot controls.
medium	Balanced protection. This is the default.
high	Stricter rate limits and tighter bot controls.
attack	Most aggressive limits, intended for active attacks.

To configure TurboShield:

1. Open the host's Security tab.
2. Enable TurboShield.
3. Select a protection level. The default is medium.
4. Save your changes.

For details on how TurboShield evaluates traffic, see the Security overview.

IP allow-list

The IP allow-list (firewall_whitelist) lets you define trusted Internet Protocol (IP) addresses, and ranges of them, that bypass rate-limiting and blocking. An IP address is the network address of a device or office, such as 203.0.113.10. A range is written in Classless Inter-Domain Routing (CIDR) notation, such as 203.0.113.0/24, which means a block of addresses. This is useful for office networks, monitoring services, and integration partners that should never be throttled or blocked.

A trusted IP is also allowed through the host firewall, so it can reach ports that are otherwise closed to the public.

1. Open the host's Security tab.
2. Add each trusted IP address or CIDR range to the firewall_whitelist.
3. Save your changes.

GeoIP filtering

GeoIP filtering lets you allow or block web traffic based on the visitor's country.

Setting	Effect
firewall_country_allow	Allow traffic only from the listed countries.
firewall_country_block	Block traffic from the listed countries.

Web Application Firewall

The Web Application Firewall (WAF) inspects each incoming web request against a managed set of rules and blocks ones that match known attack patterns. TurboStack uses Imunify for this, which also scans the files on the host for malware. It works at the application layer, which is layer 7 of the Open Systems Interconnection (OSI) network model, so it can inspect the content of a request. This is a deeper level than the network firewall, which filters traffic at the network layer (layer 3). Working at layer 7 lets the WAF stop application-level attacks from the OWASP Top 10. That is the Open Worldwide Application Security Project's industry list of the most common web application risks. The two most common patterns it stops are:

• SQL injection - an attacker tries to smuggle database commands through a form or URL to read or change your data.
• Cross-site scripting (XSS) - an attacker tries to inject malicious code into your pages so it runs in your visitors' browsers.

The WAF also applies virtual patches. A virtual patch closes a known, exploited vulnerability at the firewall before the application itself is patched. This means a newly disclosed leak can be blocked immediately, instead of waiting for an application update.

You do not write these rules yourself; TurboStack maintains them. You choose whether the WAF is on and where it sends alerts.

1. Open the host's Security tab.
2. Enable the Web Application Firewall.
3. Enter a notification email address. TurboStack sends WAF security alerts, such as malware detections, to this address.
4. Save your changes.

Automatically managed protections

The Firewall is managed automatically by TurboStack and does not require manual configuration. See the Security overview for how they fit into the overall protection model.

Related

• Security overview
• Groups
• Advanced settings
• Threat Center
• SSH access