How-to · Intermediate · 20 minutes of reading

How to Understand Website Firewalls

Everything you need to understand what a web application firewall does, where it sits, and what you would ever change — the steps in order, the snag to watch, and the tip our support desk gives everybody.

See the plans Ask us a question

Straight answer first

In a line: understand what a web application firewall does, where it sits, and what you would ever change — a intermediate-level task that takes 20 minutes of reading.

The walkthrough below covers every step, the mistake most people make, and the shortcut worth keeping. On Hosting Seller plans several of these steps are already done for you, and we say where.

Written by the Hosting Seller staff · Checked 1 August 2026

Intermediate

Skill needed

Stages to finish

Free

Help included

Tested

On our own kit

This guide assumes no expertise at all — just a hosting account, a browser and 20 minutes of reading of attention. Every instruction works on our platform exactly as written, and carries over to any standard cPanel host.

Rule of the road: read the snag section before you begin rather than after. It is harvested from the tickets of people who did it the other way round.

The whole job at a glance

Here is the route in full: see where it sits, know which layers you have, understand what it matches on, take false positives calmly and glance at the reports.

No stage needs code or a terminal unless the guide says so outright, and where it does, the exact commands are printed. The full step-by-step sits below; the sections around it give the context that makes it stick.

The classic snag

Turning the whole WAF off because one form got blocked. The cure for a false positive is a targeted exception; disabling the firewall to fix a contact form is treating a splinter with an amputation.

It is worth learning because it is not some rare edge case — it is the single most common reason this task turns into a support ticket. Knowing it up front turns the whole job from risky into routine.

The shortcut, straight from the support desk

The firewall catches what is known and automated; your update habit catches the rest. Each one covers the other's blind spot, which is exactly why neither is the whole answer on its own.

Small habits like this are the real difference between people who find hosting easy and people who find it stressful. The tools are identical; the working method is not.

The parts we have already done for you

We have automated the steps that do not deserve your time: certificates issue and reissue themselves, the installer handles application setup, the daily backup covers the what-if, and per-site settings live in a panel instead of a config file. The guide above covers what remains — the part that is actually about your site.

Stuck halfway through at an odd hour? That is exactly what round-the-clock human support is for — tell us where you are in this guide and we will pick it up from there.

A shield icon standing in for site security and DDoS filtering

Why the job is simpler on our plans

Tutorials age badly when they are written against imaginary hosting. These are written against ours: the same panel, the same installer and the same defaults you will meet.

Bring an existing site and we shift it across at no charge — usually inside 24 hours, with nothing going dark while we work.

Step by step, tested exactly as printed
The snag flagged before you reach it
The dull steps are already automated
People on hand at any hour if you stall

Why Hosting Seller

On every plan, as standard

5 steps, no filler

Each stage is a few minutes of steady clicking, with the fiddly parts marked as fiddly.

Scoped honestly

Understand what a web application firewall does, where it sits, and what you would ever change is a intermediate-level task — this guide budgets 20 minutes of reading and says which steps the platform absorbs.

Works exactly as written

Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.

Help on the counter

Stuck on step three at midnight? Support answers at any hour, mid-guide included.

The snag, named early

The classic mistake for this exact job is flagged before step one, so 20 minutes of reading stays 20 minutes of reading.

Written from real tickets

Our guides come off the support desk, so the snags flagged here are the ones people genuinely hit.

First Steps

From choosing to live

1
See where it sits
A web application firewall reads HTTP requests before your application handles them, filtering out exploit patterns — injections, path traversal, probes for known CVEs — on the way past.
2
Know which layers you have
Our protected plans run Imunify360's WAF at server level, plugins add rules inside the application, and some sites add another at the CDN edge. The layers complement each other rather than competing.
3
Understand what it matches on
A WAF compares requests against rule sets that are updated as new threats appear. That update cadence is the actual product; a stale rule set is decoration.
4
Take false positives calmly
Now and then a genuine request looks like an attack — a form message containing SQL-ish text, for instance. The fix is an exception for that rule on that path, not switching the firewall off.
5
Glance at the reports
The blocked-attack count shows how noisy the internet is by default, and a spike in the graph tells you when your site attracted somebody's deliberate attention.

In the Box

Packed with every plan

NVMe SSD storage on every shelf, not just the top one
Spam and virus filtering fitted to every mailbox
A domain free for year one when you order annually
Site migration done for you by our staff, at no charge
DDoS filtering handled out at the network edge
Nothing added at setup — no joining fee, ever
The renewal price printed on the tag matches the order price
cPanel, the panel the rest of the trade already knows
Webmail in the browser plus IMAP, POP and SMTP for your own client
LiteSpeed caching running at the server, not bolted on by plugin

Across the Counter

The questions we get asked most

Is there anything I need to set up on the server firewall?

No. It runs on maintained rule sets from the moment your plan starts. Your only involvement is the rare exception if a legitimate action trips a rule, and support can tune that in a few minutes over chat.

Is a WAF the same as DDoS protection?

Different problems. The WAF inspects what is inside each request, looking for exploits. DDoS mitigation absorbs sheer volume meant to flatten the server. Both stand in front of your site; one is reading, the other is counting.

Can I set the PHP version myself?

Yes — PHP versions are chosen per site from the control panel, so an old application and a current one can sit side by side on the same account. Extensions and per-site settings live in the same screen, and none of it needs a support ticket.

Does the price climb when the term is up?

No. What you pay to order is what you pay to renew, year after year. We do not run teaser rates, so there is no year-two ambush waiting in the calendar, and your bookkeeping can treat the hosting line as a fixed number.

Does hosting come with mailboxes?

It does — mailboxes on your own domain ship with every hosting plan, with webmail, IMAP, POP and SMTP access and spam filtering fitted as standard. There is also standalone email hosting for domains whose website lives somewhere else entirely.

How quickly can I be up and running?

Minutes, not days. The account opens the moment the order clears, the domain — free for year one on annual plans — attaches straight away, and the one-click installer puts WordPress or any of 400+ applications on the page before you leave your chair. Already have a site elsewhere? Hand it over and we move it free, usually inside a day.

Can I bring a domain I already own?

Yes, and transfers in are routine. Unlock the name at your present registrar, collect the auth code, then start the transfer from your client area. Whatever registration time is left comes across with it, and DNS keeps answering the whole way through.

Packing up and moving host? Take our checklist.

A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.

Do the launch properly this time.

From a first website to a rack of servers, moving up is a change to your account rather than a migration.

See the plans