Get this fixed
Reply < 4 hServer Firewall Setup
A badly configured firewall can be worse than none: it blocks your customers while leaving SSH or the database open to the world. We design rules around what your server actually runs, apply them in stages, and document every one.
What’s included
CSF, UFW, iptables or nftables setup
Default-deny inbound policy
SSH restricted by key and IP
Fail2ban on exposed services
cPanel / WHM and Plesk integration
Database ports closed to the internet
Mail port configuration
HTTP/HTTPS allow rules
Custom application ports
Geo-blocking where required
Port-scan detection
Documented, backed-up ruleset
How it works
Port auditEvery open port and listening service is mapped before a single rule is written.
Rule designRules are designed around your stack and who needs access to what.
Staged rolloutRules go in step by step, tested at each stage, with a safe rollback: no lock-outs.
Brute-force layerFail2ban jails tuned for SSH, web logins, panels and mail.
VerifyRequired ports confirmed open, everything else confirmed closed, from outside.
DocumentThe full ruleset is written up and backed up.
Why choose us for this
No lock-outsStaged changes with an automatic rollback timer while we test.
Panel-awareWorks with cPanel, Plesk, CloudPanel and DirectAdmin rather than fighting them.
Cloud firewalls tooAWS security groups, Hetzner and DigitalOcean firewalls aligned with the server rules.
Managed if you wantOn Premium we keep the rules up to date as your server changes.
Service FAQ
CSF suits cPanel and busy hosting servers; UFW is simpler for single-app VPS. We recommend one based on your setup and can migrate between them.
Not with our process. Rules are staged and tested, with a rollback that restores access automatically if anything goes wrong.
Yes. Your origin server can still be reached directly unless it only accepts traffic from Cloudflare, which we can set up.
Related services
Not sure which plan fits?
Start with the free audit. We’ll tell you honestly if you even need us.