# Security parameters

Every key on this page is set once per host, at the top of the configuration.
A [!badge variant="success" text="GUI"] key has a field in the interface; a
[!badge variant="warning" text="YAML only"] key is set in the
[Source (YAML) view](../../concepts/yaml-view.md), which accepts the same configuration.

## TurboShield

TurboShield protects your applications against malicious traffic. For what each mechanism
does, see [What is TurboShield?](../../technologies/turboshield/what-is.md).

**Example** - every key in this section, with realistic values:

```yaml
turboshield:
  enabled: true
  level: medium              # low | medium | high | attack
  allow_bots: [channable]
  limit_bots: [bytespider, gptbot]
  bot_protection: true       # browser check for suspicious visitors (Nginx)
```

### `turboshield.enabled`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"]

Default `true`.

Turns the protection on for this host. On by default. Switching it off removes the protection completely.

### `turboshield.level`

[!badge variant="info" text="enum"] [!badge variant="success" text="GUI"]

One of `low`, `medium`, `high`, `attack`. Default `medium`.

How aggressive the limits are, and whether the attack-only mechanisms run. Raise it while an attack is happening, and lower it again afterwards.

### `turboshield.allow_bots`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"]

Default `empty`.

Bots that are never slowed down. Protects crawlers your revenue depends on, such as marketplace and comparison feeds.

### `turboshield.limit_bots`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"]

Default `empty`.

Bots that are strictly slowed down. Your lever against crawlers that consume capacity without bringing customers.

### `turboshield.bot_protection`

[!badge variant="info" text="boolean"] [!badge variant="warning" text="YAML only"]

Default `false`.

Shows suspicious visitors an automatic browser check before they reach your site. Effective against scraping and credential stuffing spread across many addresses.

**Note:** requires Nginx.

## Trusted addresses and the firewall

The firewall controls which networks and ports reach the server at all. The trusted list is
shared with TurboShield.

**Example** - every key in this section, with realistic values:

```yaml
firewall_whitelist:
  - 203.0.113.10         # office
  - 198.51.100.0/24      # partner integration
firewall_country_block: "CN,RU"
# Or restrict to only certain countries instead:
# firewall_country_allow: "BE,NL,FR"
firewall_tcp_ports: [80, 443, 8080]
firewall_udp_ports: [53]
```

### `firewall_whitelist`

[!badge variant="info" text="list"] [!badge variant="success" text="GUI"]

Default `empty`.

Addresses that bypass every check and can never be blocked automatically. The most important list to maintain. Prevents your own office, integrations and monitoring from being locked out.

> [!WARNING]
> A trusted address skips all protection. Keep the list short and never add a broad public range.

### `firewall_country_block`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"]

Refuses all traffic from the listed countries. Cuts a lot of unwanted traffic when you only sell in certain regions.

> [!WARNING]
> Blocks real customers and travelling staff in those countries.

### `firewall_country_allow`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"] [!badge variant="ghost" text="advanced"]

Allows traffic only from the listed countries. For applications meant for one region only, such as an internal tool.

> [!WARNING]
> Everything else is refused, including search engines and monitoring.

### `firewall_tcp_ports`

[!badge variant="info" text="list"] [!badge variant="warning" text="YAML only"]

Default: Detected automatically.

Which TCP ports the firewall opens. Open a port for your own service.

> [!WARNING]
> Every open port is a way in. Only open what you actually use.

### `firewall_udp_ports`

[!badge variant="info" text="list"] [!badge variant="warning" text="YAML only"] [!badge variant="ghost" text="advanced"]

Default: Detected automatically.

Which UDP ports the firewall opens. For services that do not use TCP.

## Web Application Firewall

The Web Application Firewall (WAF) inspects incoming requests and blocks attacks against the
application itself, such as SQL injection and cross-site scripting. It also scans the files on
the host for malware. TurboStack uses Imunify for this. You switch it on per host on the
**Security** tab.

**Example** - every key in this section, with realistic values:

```yaml
imunify:
  enabled: true
  email: security@example.com
```

### `imunify.enabled`

[!badge variant="info" text="boolean"] [!badge variant="success" text="GUI"]

Default `false`.

Installs and activates the Web Application Firewall and malware scanning on the host. Blocks application-layer attacks that the network firewall cannot see, and finds malware in your files.

### `imunify.email`

[!badge variant="info" text="string"] [!badge variant="success" text="GUI"]

The address that receives Web Application Firewall alerts, such as a malware detection. Without it you only see findings when you open the interface yourself.

**Note:** only used when `imunify.enabled` is true.

## Related

- [YAML configuration reference](index.md)
- [The Source (YAML) view](../../concepts/yaml-view.md)
- [Publishing changes](../../platform/hosts/publishing.md)