What is PortWall?
PortWall is a self-hosted web application firewall (WAF): it inspects every request to your websites, refuses attacks and blocks attackers at the firewall, on servers you control. It runs on the Windows server in front of IIS, or as a Linux appliance in front of any web servers. See What PortWall is.
Does my traffic go through a third-party cloud?
No. PortWall runs on your own server or appliance, and on your own servers; the traffic PortWall inspects and the logs it writes stay under your control. See Data PortWall sends, and what stays with you.
Which web servers does PortWall protect?
PortWall for Windows protects IIS sites on the server it is installed on, including servers managed by SolidCP or Plesk for Windows. The Linux appliance protects any website it can reach over the network, whatever web server runs it.
Does PortWall for Windows protect every site on the server?
Yes. One Windows licence covers every IIS site on the licensed server, and new sites are picked up automatically.
How much does PortWall cost?
Windows is $49 (Standard), $99 (Premium) or from $199 (Enterprise) per server per month. The Linux appliance Premium is $499 a month for 2 cores, up to $2,999 for 32 cores; Enterprise is quoted by sales. Paying annually gets 12 months for the price of 10. Prices are in USD, per month or per year, excluding applicable taxes. See Prices.
What is the difference between Standard, Premium and Enterprise?
Standard is the complete WAF with host security, threat feeds, geo-blocking and upload scanning. Premium adds Premium Threat Intelligence, herd immunity, bot protection and the Smart Tuning Advisor. Enterprise adds full API protection: specification checks, JWT validation, CORS controls and GraphQL limits. See Choosing an edition.
Is there a Standard edition of the Linux appliance?
No. The appliance starts at Premium, so every appliance licence includes bot protection, Premium Threat Intelligence, herd immunity and the Smart Tuning Advisor. Enterprise adds API protection.
How are appliance cores counted?
A virtual CPU counts as one core on a virtual machine or cloud instance; a physical core (with its hyper-threads) counts as one core on a physical server. The licence sets how many cores inspect traffic; the operating system and console use every core.
Does a core licence guarantee a number of requests per second?
No. A core count is a licensing unit: what each core handles depends on the processor, HTTPS traffic, request sizes and the features in use. Ask [email protected] for sizing advice.
Can I change edition or core count later?
Yes. Your configuration is kept when you move between editions, and a larger appliance core licence takes effect within a minute, without a restart. Write to [email protected] to change your licence.
How do I buy PortWall?
Order in the customer portal and pay the invoice; your licence key then appears on the service's page in the portal. See How to buy PortWall and get your licence key.
Where do I find my licence key?
In the customer portal: open Services, choose your PortWall licence, and the key is in the Your PortWall licence panel, with a Copy button. See How to buy PortWall and get your licence key.
Can I move my licence to a new server?
Yes. Enter the key on the new server; the old one stops being licensed after its grace period. You have two in 30 days (a change of public address counts as a move) moves; if you need more, open a ticket and we will release the licence.
What happens if my licence lapses or the server cannot reach PortWall?
Protection carries on for a grace period of up to 72 hours. After that, blocking steps back but detection continues and nothing you set is lost; blocking returns as soon as the licence is confirmed again. See Licences, editions and licence states.
Are refunds available?
Fees are non-refundable except where required by law or expressly stated (Terms of Service). Annual plans are not refunded, in whole or in part, if cancelled before the end of the year.
Will installing PortWall interrupt my sites?
No. Installing changes nothing for your sites: they keep running as before until you move them behind PortWall in the console's setup wizard. See Move your IIS sites behind PortWall.
Can I undo it?
Yes. The setup wizard can return traffic to IIS at any time, and running C:\Users\Administrator\Downloads\portwall-install.exe --uninstall from an elevated PowerShell puts the server
back the way PortWall found it. It works even if your licence has expired or been cancelled. See
Uninstall PortWall from Windows Server.
Where do I download PortWall for Windows?
From portwall.net/download. The page has portwall-install.exe, a small web installer
(about 6.6 MB) with its SHA-256 checksum. Run it as Administrator and enter your licence key: it downloads the current
PortWall installer, checks it and opens it with your key already filled in. The full installer is no longer downloadable
by itself, because releases are available to licensed servers only. See
Install PortWall on Windows Server.
What does the server need to reach for installing and updating?
Outbound HTTPS to dl.portwall.net and to PortWall's licence service. Installs and updates are both downloaded from
dl.portwall.net, so allow it if the server's outbound traffic is filtered. See System requirements.
Why does Windows warn me about the installer?
portwall-install.exe is not yet signed with a Windows code-signing certificate, so Windows shows an unknown-publisher
warning. portwall-install.exe checks the installer it downloads against PortWall's checksum, and the installer checks
PortWall's release signature before it installs anything. See
Install PortWall on Windows Server.
Will PortWall block my legitimate visitors?
Not while you are setting it up: a new site starts in detection mode, which records what would be blocked and blocks nothing. You fix any false positives, then switch the site to blocking. See Sites and WAF modes.
A legitimate visitor or request is being blocked. What do I do?
Find the request in the Attack Feed, and add a narrow exclusion for the rule that blocked it from the site's Tuning page; Premium editions suggest the exclusion for you. See Sites and WAF modes.
My own address got blocked. How do I stop that?
Add your address to the Allowlist: an allowlisted address is never blocked by any feed, geo policy or detection. See Allowlist and outbound control.
Does PortWall handle HTTPS certificates?
Yes. It can reuse each site's existing certificate, obtain and renew free certificates from Let's Encrypt or Google Trust Services, or use your own. See TLS and SSL certificates.
Do my applications still see the visitor's real IP address?
Yes, on Windows: PortWall passes the real visitor address to IIS logs and applications. On the appliance, the address
is passed to the backend server in the X-Forwarded-For header.
Does PortWall scan uploads for malware?
Yes, in every edition: each uploaded file is scanned before the site receives it, by Microsoft Defender on Windows and ClamAV on the appliance. See Upload scanning.
Does PortWall protect against brute-force logins?
Yes, in every edition. It protects your sites' login pages and, on Windows, Windows, RDP, SMB, mail and SQL Server logins. See Brute-force protection.
Does PortWall protect against DDoS attacks?
Partly. PortWall runs on your own server, so it can only deal with traffic that reaches the server. It does not stop a large distributed denial-of-service (DDoS) attack that fills your server's internet connection: that needs protection before the traffic arrives, from your hosting provider or a CDN such as Cloudflare. PortWall works behind a CDN: add it on the Trusted Proxies page, so PortWall limits and blocks the real visitor addresses rather than the CDN's.
The same holds for a DDoS aimed at one page, such as a login form: PortWall handles the requests that reach the server, but not an attack big enough to fill the connection.
What PortWall does handle is a flood of requests that reaches the server, such as one aimed at a login form:
- Per-visitor rate limit, in every edition and on by default: an address going over 1,200 requests a minute from one address gets a quick 429 Too Many Requests before the request is inspected. Change it under Global WAF Defaults › Rate limiting.
- Route limits, in every edition: a lower limit for one path, such as the login page, set on the API Protection page. See API protection.
- Login protection, in every edition: give the site's login path and an address that keeps failing to log in is blocked for a limited time. The WordPress or forum preset also limits how often one visitor can use the login, comment and sign-up pages. See Brute-force protection.
- Overload protection, in every edition: caps how many large form or API requests are inspected at once, for the whole server and per visitor, so a burst of them cannot exhaust the server.
- The browser check, in Premium and Enterprise on Windows and every appliance edition: for a site under attack, every visitor must pass a short check in the browser, which bots and attack tools that cannot run JavaScript do not get through. See Bot protection.
An attack spread over many addresses, each staying under the limits, is harder for any server-side tool to stop; the browser check is the answer to that on a single site.
How are updates installed?
When a release is offered, the console shows a banner and installs it when an administrator approves, or by itself in your maintenance window if you choose automatic updates. A release that does not start healthy is rolled back to the version you had. See Install PortWall on Windows Server.
What data does PortWall send?
Licence check-ins, and summaries of the public addresses that attacked your server (address, time, count and kind of attack). Never visitor data, URLs, request contents or site names. See Data PortWall sends, and what stays with you.
How do I get support?
Open a ticket in the customer portal or write to [email protected]. The office is open Sunday to Thursday, 09:00 to 18:00 Gulf Standard Time. Report a security problem in PortWall itself to [email protected]. See Licences, editions and licence states for what to include.