Security

The host's Security tab is where you configure how incoming web traffic is protected. This page covers the practical configuration steps. For how the underlying protections work, see the Security overview.

The tab has a menu on the left with three panes. Select one to configure it:

• TurboShield - traffic filtering, bot controls and attack detection
• Firewall - the IP allow-list, GeoIP filtering and the open ports
• Web Application Firewall - block requests matching known attack patterns

TurboShield

TurboShield protects your applications against malicious web traffic and Distributed Denial of Service (DDoS) attacks - attempts to overwhelm your site with so many requests that it goes offline. It applies rate limits, a cap on how many requests one visitor can make. It adds bot controls, which tell good automated visitors from bad ones. It also detects attack behavior and temporarily bans the source. You can enable or disable it per host and choose a protection level. For everything it does and every setting, see What is TurboShield? and Configure TurboShield.

Throttled visitors receive a soft 429 (Too Many Requests) response rather than being banned at the firewall, so legitimate traffic recovers automatically once it slows down. This matters for you because it means search engines and real customers are not locked out when traffic spikes. Bans, which only follow clear attack behavior, always expire on their own.

Level	Behavior
low	Lenient rate limits; minimal bot controls.
medium	Balanced protection. This is the default.
high	Stricter rate limits and tighter bot controls.
attack	Most aggressive limits, intended for active attacks.

To configure TurboShield:

1. Open the host's Security tab and select TurboShield.
2. Enable TurboShield.
3. Select a protection level. The default is medium.
4. Save your changes.

For details on how TurboShield evaluates traffic, see the Security overview.

Firewall

The Firewall pane holds everything about which networks and ports reach the server. It contains the IP allow-list and GeoIP filtering, with the port lists behind Advanced Settings.

TurboStack manages the firewall for you: the ports your applications need are opened automatically when you publish, and the monitoring and management addresses it needs are always allowed. You only change something here when you have a reason to.

IP allow-list

The IP allow-list (firewall_whitelist) lets you define trusted Internet Protocol (IP) addresses, and ranges of them, that bypass rate-limiting and blocking. An IP address is the network address of a device or office, such as 203.0.113.10. A range is written in Classless Inter-Domain Routing (CIDR) notation, such as 203.0.113.0/24, which means a block of addresses. This is useful for office networks, monitoring services, and integration partners that should never be throttled or blocked.

A trusted IP is also allowed through the host firewall, so it can reach ports that are otherwise closed to the public.

1. Open the host's Security tab and select Firewall.
2. Add each trusted IP address or CIDR range to the firewall_whitelist.
3. Save your changes.

GeoIP filtering

GeoIP filtering lets you allow or block web traffic based on the visitor's country.

Setting	Effect
firewall_country_allow	Allow traffic only from the listed countries.
firewall_country_block	Block traffic from the listed countries.

Open ports

Advanced Settings in the Firewall pane holds the two port lists. Both show Default (Auto Managed) until you set them, which means TurboStack decides which ports to open from the services the host runs.

Setting	What it does
firewall_tcp_ports	The Transmission Control Protocol (TCP) ports the firewall opens, for example 22, 80, 443.
firewall_udp_ports	The User Datagram Protocol (UDP) ports the firewall opens, for example 123.

Set these only to open a port for a service of your own that TurboStack does not know about. Setting a list replaces the automatic one, so it must include every port you still need.

Trusted proxies and CDNs

When a content delivery network (CDN) or reverse proxy sits in front of the server, requests arrive from the proxy rather than the visitor. Cloudflare and Akamai are recognised automatically. For your own proxy, list its addresses in remote_trusted_proxies so the real visitor address is restored in the logs and the security rules, and the proxy itself is not blocked.

Web Application Firewall

The Web Application Firewall (WAF) inspects each incoming web request against a managed set of rules and blocks ones that match known attack patterns. TurboStack uses Imunify for this, which also scans the files on the host for malware. It works at the application layer, which is layer 7 of the Open Systems Interconnection (OSI) network model, so it can inspect the content of a request. This is a deeper level than the network firewall, which filters traffic at the network layer (layer 3). Working at layer 7 lets the WAF stop application-level attacks from the OWASP Top 10. That is the Open Worldwide Application Security Project's industry list of the most common web application risks. The two most common patterns it stops are:

• SQL injection - an attacker tries to smuggle database commands through a form or URL to read or change your data.
• Cross-site scripting (XSS) - an attacker tries to inject malicious code into your pages so it runs in your visitors' browsers.

The WAF also applies virtual patches. A virtual patch closes a known, exploited vulnerability at the firewall before the application itself is patched. This means a newly disclosed leak can be blocked immediately, instead of waiting for an application update.

You do not write these rules yourself; TurboStack maintains them. You choose whether the WAF is on and where it sends alerts.

1. Open the host's Security tab and select Web Application Firewall.
2. Enable the Web Application Firewall.
3. Enter a notification email address. TurboStack sends WAF security alerts, such as malware detections, to this address.
4. Save your changes.

Related

• Security overview
• Security parameters (YAML)
• Groups - apply these settings to many hosts at once
• Advanced settings
• Threat Center - the findings, rather than the configuration
• SSH access