About PortWall
What PortWall isPortWall is a web application firewall (WAF) you run on your own infrastructure: on the Windows server in front of IIS, or as a Linux appliance in front of any web servers. It inspects every request, refuses attacks, blocks attackers at the firewall and passes clean traffic on.Windows or the Linux appliance: which one fitsChoose PortWall for Windows when your sites run on IIS and you want protection on the same server, including Windows host security. Choose the Linux appliance when your sites run elsewhere or on other web servers, or when you want one gateway in front of many servers and tenants.Choosing an editionWindows comes in Standard, Premium and Enterprise; the Linux appliance in Premium and Enterprise. Standard is the WAF with host security; Premium adds Premium Threat Intelligence, herd immunity, bot protection and the Smart Tuning Advisor; Enterprise adds full API protection.PricesWindows is priced per server per month: Standard $49, Premium $99, Enterprise from $199. The Linux appliance Premium is priced by CPU cores, $499 a month for 2 cores up to $2,999 for 32; Enterprise is quoted. Paying annually costs 10 times the monthly price: 12 months for the price of 10. Prices are in USD, excluding taxes.System requirementsPortWall for Windows needs Windows Server 2016 or later (64-bit) with IIS, an Administrator account, 2 GB of free disk and outbound HTTPS to dl.portwall.net and PortWall's licence service. The Linux appliance needs 4 GB of memory, 20 GB of disk, an address visitors can reach, a route to each site's server and outbound HTTPS.How to buy PortWall and get your licence keyOrder the edition you need in the PortWall customer portal at portwall.net/billing. Once the invoice is paid, your licence key appears on the service's page in the portal; enter it when PortWall's installer or setup asks for it.Data PortWall sends, and what stays with youPortWall inspects your traffic on your own servers; requests, visitor data and logs never leave them. A licensed server sends PortWall only its licence check-ins and summaries of the public addresses that attacked it, which build the threat intelligence every PortWall server receives.Frequently asked questionsShort answers to the questions people ask most about PortWall: what it protects, editions and prices, licensing, installing, false positives, performance, data and support.
Getting started
Install PortWall on Windows ServerDownload the small web installer, portwall-install.exe, from portwall.net/download and run it as Administrator on a Windows Server 2016 or later machine with IIS. Enter your licence key and it downloads and opens the current PortWall installer for you; then sign in to the console and run the setup wizard. Installing changes nothing for your sites until you move them behind PortWall in the console.Install the PortWall Linux applianceCreate a virtual machine from the appliance image (or install from the ISO), open https://<address>:9443, enter the setup code shown on the appliance's screen, then add your sites and point their DNS at the appliance.Move your IIS sites behind PortWall (cutover)The Set up PortWall wizard finds your IIS sites, prepares a private address for IIS, and then moves the public web ports 80 and 443 to PortWall so every request is inspected before IIS gets it. You can return traffic to IIS at any time.Protection status and the errors panelThe Overview's Protection status cards show, for each feature, whether it is turned on and whether it is actually enforcing. Anything on but not working turns red there, in the top-right errors panel and on the feature's page.
Protecting your sites
Sites and WAF modes: from watching to blockingEach site runs in a mode: off, detection only (log, never block) or blocking. Start in detection, fix false positives from the site's Tuning page, then switch the site to blocking.TLS and SSL certificatesEvery site behind PortWall is served over HTTPS with the certificate set on the TLS / SSL certificates page: one reused from the control panel, a free one PortWall obtains and renews from Let's Encrypt or Google Trust Services, or your own.Upload scanning (malware in uploaded files)Every file uploaded to a protected site is scanned before the site receives it; a malicious file is refused with a 403 and shown in the Attack Feed. It is on by default: Microsoft Defender scans on Windows, ClamAV on the appliance.Threat-intelligence feedsThreat-intelligence feeds are public lists of known-bad IP addresses that PortWall turns into firewall drop rules, so that traffic is refused before it reaches your sites. Your allowlist always wins over a feed.Premium Threat IntelligencePremium Threat Intelligence scores every address seen attacking PortWall servers and sends your server a signed list of the ones that keep coming back, so they are stopped before they reach your sites. It is included in Premium and Enterprise.Geo-blocking (block countries)Geo-blocking refuses traffic from chosen countries on chosen ports at the firewall, or only records it in audit mode. An option lets certificate checks through so Let's Encrypt can still renew your certificates, and search-engine crawlers are let through by default so your sites stay in search results.Bot protection and the browser checkBot protection stops automated traffic that WAF rules do not: scrapers, credential-stuffing tools and floods of ordinary-looking requests, using a browser check, TLS fingerprints and per-visitor limits. It is included in Premium and Enterprise.API protectionAPI requests are inspected like any other, JSON and XML included. Every edition can limit an API's methods and routes; Enterprise adds specification checks, CORS controls, JWT validation and GraphQL limits.Virtual patchesA virtual patch refuses the requests that exploit a known flaw until the software is updated. PortWall supplies patches for new vulnerabilities, and you can write your own.Built-in protections (PHP2Shell)Built-in protections are now the PortWall patches on the Virtual Patches page, including the PHP2Shell protection.Brute-force protection (website and Windows logins)PortWall detects password guessing against your sites' login pages and, on Windows, against Windows, RDP, mail and SQL Server logins, and blocks a persistent attacker for a limited time.Allowlist and outbound (egress) controlAn address on the allowlist is never blocked by any feed, geo policy or detection. Outbound (egress) control limits what each site's application may connect out to, so a compromised site cannot send data away; start in audit, then enforce.Notifications and alert emailChoose which events notify you (attack campaigns, tampering, a protection that stopped enforcing) and where they go: email or webhooks.
Running PortWall
Back up, restore and move PortWall to a new serverBackup & Restore exports your whole configuration as one file and imports it back, for disaster recovery or for moving to another server. A licence key must be entered again on a different machine.API keys for scripts and integrationsAPI keys let scripts reach the management API without a shared password. Create them on the API Keys page, with the least role the script needs.Using the PortWall API: examples for common tasksPortWall's management API lets scripts do what the console does. Create a key on the console's API Keys page, send it in the X-Api-Key header to http://127.0.0.1:5000/api on the server, and use the examples here to check protection, list sites, change a site's mode, block or allowlist addresses, export attacks and back up the configuration.Two-factor authentication for the consoleTwo-factor authentication adds a code from an authenticator app to each operator's console sign-in. Each operator turns it on for their own account.Operators and rolesOperators are the people who sign in to the console. Admins manage them on the Users page; each is an Admin (full control) or a Viewer (read-only).Uninstall PortWall from Windows ServerRun portwall-install.exe --uninstall from an elevated PowerShell: it downloads the PortWall installer and runs its uninstaller, which returns your sites to IIS, undoes every change PortWall made to the server, and then removes PortWall. It works even if your licence has expired or been cancelled.
Troubleshooting
Reference
Licences, editions and licence statesOne licence key covers one Windows server or one appliance. The Licence page shows the state (Licensed, Grace or Unlicensed) and your edition; if the licence lapses, detection continues and blocking returns as soon as it is renewed.Command-line tool (portwall-admin)portwall-admin (C:\portwall\control-plane\portwall-admin.exe on a default install; it is not on the system path) works on the server itself, with no API key or network: reset a password, turn off two-factor, restore a backup, and run diagnose to find problems.Release notesWhat changed in each PortWall release: new features and fixes, in plain terms.
API reference
PortWall API referenceThe documented PortWall management API: where it answers, how to authenticate with an API key, the roles, how errors and background changes work, what PortWall promises about compatibility, and a page per area.API reference: status and licenceCheck that the API answers, that protection is enforcing, and the licence state; enter a licence key; and wait for a saved change to be in force with GET /api/config-apply/status.API reference: sitesList sites, read and change one site's settings, switch sites between watching (DetectionOnly) and blocking (On), remove a site, and roll a site back to a saved revision.API reference: virtual patchesList, add, switch between detecting and blocking, and delete a site's own virtual patches.API reference: outbound (egress) controlRead, set and remove a site's outbound (egress) policy, which limits what the site's application may connect out to.API reference: blocking addressesList blocked addresses, block an address for a time or permanently, unblock one, and remove every temporary block at once.API reference: allowlistList the allowlist, allowlist an address or range from the WAF, the feeds or both, and remove an entry.API reference: attacks, campaigns and the audit logPage through recorded attacks (with a since filter for exports), list attack campaigns, and read the audit log of who changed what.API reference: threat-intelligence feedsList the threat-intelligence feeds and their state, turn the feeds on or off, and change one feed's action.API reference: geo-blockingList, create, change and delete geo-blocking policies, and turn geo-blocking on or off, and let search-engine crawlers through.API reference: brute-force protectionRead and change the brute-force protection settings for website and Windows logins.API reference: bot protectionRead and change the bot-protection settings: the browser check, its sites and exempt paths, TLS fingerprinting and the actions for bot clusters and credential stuffing.API reference: notificationsRead and change which events send alerts and where they go.API reference: backup and restoreDownload the whole configuration as one file and restore it, with a dry run that reports what would change.API reference: API keysList API keys, create one with the Admin, Viewer or Tenant role, and revoke one.API reference: tenants (for hosting providers)Give sites to tenants, let panel users see or manage a site, and set the tenant policy that bounds what tenants may change.API reference: the tenant APIWhat a Tenant key can do on the tenant's own sites: list and change them within the host's policy, scan files, handle quarantined files, read attacks and get a security report.API reference: data typesEvery object the PortWall API sends or accepts, field by field, with the values each list of choices can take.