Security parameters

The YAML keys for TurboShield and the firewall - protection level, bot lists, trusted clients, country rules and ports.

Every key on this page is set once per host, at the top of the configuration. A GUI key has a field in the interface; a YAML only key is set in the Source (YAML) view, which accepts the same configuration.

TurboShield

TurboShield protects your applications against malicious traffic. For what each mechanism does, see What is TurboShield?.

Example - every key in this section, with realistic values:

turboshield:
  enabled: true
  level: medium              # low | medium | high | attack
  allow_bots: [channable]
  limit_bots: [bytespider, gptbot]
  bot_protection: true       # browser check for suspicious visitors (Nginx)

turboshield.enabled

boolean GUI

Default true.

Turns the protection on for this host. On by default. Switching it off removes the protection completely.

turboshield.level

enum GUI

One of low, medium, high, attack. Default medium.

How aggressive the limits are, and whether the attack-only mechanisms run. Raise it while an attack is happening, and lower it again afterwards.

turboshield.allow_bots

list GUI

Default empty.

Bots that are never slowed down. Protects crawlers your revenue depends on, such as marketplace and comparison feeds.

turboshield.limit_bots

list GUI

Default empty.

Bots that are strictly slowed down. Your lever against crawlers that consume capacity without bringing customers.

turboshield.bot_protection

boolean YAML only

Default false.

Shows suspicious visitors an automatic browser check before they reach your site. Effective against scraping and credential stuffing spread across many addresses.

Note: requires Nginx.

Trusted addresses and the firewall

The firewall controls which networks and ports reach the server at all. The trusted list is shared with TurboShield.

Example - every key in this section, with realistic values:

firewall_whitelist:
  - 203.0.113.10         # office
  - 198.51.100.0/24      # partner integration
firewall_country_block: "CN,RU"
# Or restrict to only certain countries instead:
# firewall_country_allow: "BE,NL,FR"
firewall_tcp_ports: [80, 443, 8080]
firewall_udp_ports: [53]

firewall_whitelist

list GUI

Default empty.

Addresses that bypass every check and can never be blocked automatically. The most important list to maintain. Prevents your own office, integrations and monitoring from being locked out.

Note: this is the key for granting one address access. It does not open ports, and it is not firewall_tcp_ports, which replaces the whole list of open ports.

firewall_country_block

string GUI

Refuses all traffic from the listed countries. Cuts a lot of unwanted traffic when you only sell in certain regions.

firewall_country_allow

string GUI advanced

Allows traffic only from the listed countries. For applications meant for one region only, such as an internal tool.

firewall_tcp_ports

list GUI

Default: Detected automatically.

The complete list of Transmission Control Protocol (TCP) ports the firewall opens. It replaces the list the platform maintains for you - it does not add to it. To open a port for your own service. Leave it unset unless you need that: the ports your server already needs are detected and kept up to date for you.

Note: list every port the server must keep, not only the one you are adding. Whatever you leave out is closed. A normal web server needs at least 80 and 443, and a mail or control-panel server needs considerably more.

firewall_udp_ports

list GUI advanced

Default: Detected automatically.

The complete list of UDP ports the firewall opens. Like firewall_tcp_ports, it replaces the maintained list rather than adding to it. For services that do not use TCP.

CDN and reverse proxies

When a CDN or a reverse proxy sits in front of the server, every request arrives from that proxy's address instead of the visitor's. Listing the proxy here restores the real visitor address in the web server logs and in the security rules, and keeps the proxy itself from being blocked. Cloudflare and Akamai are trusted already, so you only add your own. This key has no field on the Security tab yet - set it in the Source (YAML) view or over the API.

Example - every key in this section, with realistic values:

remote_trusted_proxies:
  - 203.0.113.0/24       # our image CDN
  - 198.51.100.7         # mirror fetcher

remote_trusted_proxies

list YAML only advanced

Default empty.

Addresses or ranges of your own CDN or reverse proxy whose forwarded visitor address the server may trust. Without it every request looks like it comes from the proxy, so logs, country rules and rate limits all see one address instead of the real visitor.

Web Application Firewall

The Web Application Firewall (WAF) inspects incoming requests and blocks attacks against the application itself, such as SQL injection and cross-site scripting. It also scans the files on the host for malware. TurboStack uses Imunify for this. You switch it on per host on the Security tab.

Example - every key in this section, with realistic values:

imunify:
  enabled: true
  email: security@example.com

imunify.enabled

boolean GUI

Default false.

Installs and activates the Web Application Firewall and malware scanning on the host. Blocks application-layer attacks that the network firewall cannot see, and finds malware in your files.

Note: a licensed add-on - it has to be part of your contract, or publishing fails. Once active, its console is at https://<host>/imunify; log in with a system user from the Credentials tab.

imunify.email

string GUI

The address that receives Web Application Firewall alerts, such as a malware detection. It is also set as the contact for every system user in the console. Without it you only see findings when you open the console yourself.

Note: only used when imunify.enabled is true. Alerts are sent from <hostname>@servermailer.cloud.

© 2026 Hosted Power — TurboStack