Start with C:\portwall\control-plane\portwall-admin.exe diagnose --all on the box — it checks the common problems and explains them in plain English, with no API key or network needed. See the command-line reference.
The commands on this page assume PortWall is installed in the default folder, C:\portwall. If you chose another folder when you installed it, replace C:\portwall with that folder.
Windows says it protected your PC, or the publisher is unknown
This is expected: the installer is not yet signed with a Windows code-signing certificate. Click More info, then Run anyway. See Windows warns about the installer for each warning and how to check you have the genuine file.
The installer stops before installing
The installer checks the server first and changes nothing until the checks pass. Press Check only to see them. It stops for one of these reasons:
- Not running as Administrator. Start it from an elevated prompt (or right-click, Run as administrator).
- Windows too old, or not 64-bit. PortWall needs 64-bit Windows Server 2016 or later.
- Less than 2 GB free on the install drive.
- The licence server could not be connected or verified. The server needs outbound HTTPS to the internet. Check the firewall and any proxy. To install now and enter the key later, tick Install without a licence; see Licensing.
- The install folder already holds an installation. The installer will not install over it. Press Upgrade to upgrade it in place (the licence, settings and data are kept), or choose another folder. To remove the old one first, see Uninstalling PortWall (Windows).
IIS not being found, or another antivirus than Microsoft Defender being active, are warnings, not stops. With another antivirus, exclude PortWall's folders yourself or it can quarantine the rule set and logs.
The console will not open from another computer
That is by design. The console listens on http://127.0.0.1:5000, on the server only, so a browser on another computer times out. Open it on the server, or publish it over TLS from TLS / SSL.
One site is suddenly busy, or the server's CPU is high
Open Traffic. Busiest right now shows which sites are taking the requests; click one to see, under Who is sending it, its busiest client addresses and networks over the last minute or 5 minutes, its most requested URLs over the same time, and the requests it is working on right now. A few addresses with a large share usually means a bot or a single heavy user; many addresses in a few networks (shown as /24 or /48) usually means a crowd of real visitors, for example on a mobile network. Most requested URLs shows what they are asking for: one page or file taking most of the requests (a login page, a search, a feed) points at what to rate-limit or exclude, while many different URLs that each appear once or twice, often for files the site does not have, usually means a scanner. URLs are shown without their query string, and a long one is shortened and ends in "…". To slow a client down, add a rate limit; to refuse it, block the address.
A legitimate visitor is blocked
Find the request in the Attack Feed, note the rule id, and add a rule exclusion for that site. See Sites & the WAF. To stop blocking while you tune, put the site back in DetectionOnly.
Protection stopped after the licence lapsed
The Licence page shows the state. While Unlicensed, PortWall keeps detecting attacks but stops blocking. Enter your key to restore it. See Licensing.
Sites are 404 / not serving after a cutover or revert
Windows sometimes does not actually release or restore the web-port listen-list until the machine is rebooted — the console can report success while nothing is listening. Reboot the server. PortWall will tell you when a reboot is required. This is a Windows behaviour, not a PortWall fault.
Threat-intel feeds are on but no firewall rules
The Overview card will be red — "enabled with N entries but ZERO firewall rules." Usually one of:
- A bad entry in a feed — recent builds drop the bad entry and program the rest, so it self-heals on the next refresh. If it persists, check the worker log for
Threat-intel refresh pass failed. - Licence inactive — enforcement is withheld while unlicensed; re-activate on the Licence page (detection keeps running meanwhile).
See Threat-intel feeds.
Brute-force warns "off, N undetected" but I have brute-force on
That card is specifically Windows-account (RDP/SMB/local login) detection, which is separate from web brute-force. The warning means real Windows logon-failures are going unseen because the Windows Security-log source is off. Turn it on if you want RDP/SMB attacks caught. See Brute-force detection.
I configured alert email but never receive alerts
- Click Send test on the Notifications page — it tries the current values and shows SMTP's own error if it fails.
- Check the Alert Email card on the Overview: if the saved credentials are failing, it turns red with the exact SMTP reason.
- Make sure the event types you expect are ticked, and that the CrsHit score floor isn't hiding low-score hits. See Notifications.
Locked out of the console
Reset the admin password from the box (elevated):
C:\portwall\control-plane\portwall-admin.exe reset-password --user admin --generate
If two-factor is the blocker, clear it:
C:\portwall\control-plane\portwall-admin.exe disable-2fa --user <name>
The version I'm running
The running build is shown at the bottom-left of every page — the one number that cannot be stale. After an update, confirm it changed there.
Still stuck?
Run C:\portwall\control-plane\portwall-admin.exe diagnose --all --report C:\portwall\diagnose.txt and review the report; it names the cause of most issues and the next step to take.
If that does not solve it, write to PortWall at [email protected] and attach the report. Getting help lists what else to include.