THE PORTWALL SECURITY PLATFORM

Layered application security.
One operating model.

PortWall combines request inspection, bot controls, API policy checks and threat intelligence in a security platform designed for self-managed infrastructure.

CAPABILITIES

Protection at the layers
where abuse happens.

Availability of individual capabilities depends on edition and deployment. The edition comparison shows what is included in each plan.

⌁

Web application firewall

Inspect inbound HTTP/S traffic before it reaches the protected application, using configurable policies and rules to identify suspicious requests.

  • Protection against common injection and scripting attacks
  • Request and response policy controls where supported
  • Virtual patching and targeted rule exclusions
  • Monitor-first rollout and blocking policies
◉

Bot detection & protection

Apply controls to automated traffic that may scrape content, abuse endpoints or create excessive request volume.

  • Configurable bot detection and mitigation
  • JA4/TLS fingerprint-based signals where enabled
  • Rate limits and policy-based response actions
  • Verified-bot handling according to configured policy
{ }

API security

Give APIs explicit policy checks beyond generic web attack detection. Available in Enterprise tiers.

  • API specification conformance checks
  • JWT validation against configured requirements
  • CORS policy checks and enforcement
  • GraphQL query and resource limits
⌘

Threat intelligence & herd immunity

Share confirmed threat indicators across participating instances to help other deployments recognize repeat activity sooner.

  • Shared malicious-source indicators
  • Cross-instance and cross-tenant campaign correlation where enabled
  • Configurable allowlists and block policies
  • Privacy-conscious indicator sharing controls
✳

Smart tuning

Help teams review detections and refine narrow exceptions without disabling broad protection unnecessarily.

  • Monitor mode for initial observation
  • Targeted exclusions to reduce false positives
  • Reviewable policy changes
  • Configuration preview and rollback where supported
◈

TLS fingerprinting & traffic controls

Use connection and traffic signals as additional context for detecting campaigns and applying rate or access policies.

  • JA4/TLS fingerprint signals where supported
  • Geo-based controls at supported ports
  • Rate limiting and request-volume controls
  • Operational event visibility and alerting
▤

Malware and file controls

Windows editions include host-oriented malware and file protections as supported by the configured environment.

  • Malware scanning integration
  • Webshell and suspicious upload controls where enabled
  • File integrity monitoring and quarantine where supported
  • Host-specific protections on Windows
▦

Centralized operations

Give administrators a consistent place to configure policies, review activity and manage supported deployments.

  • Web management console
  • Security events and audit visibility
  • Multi-tenant management for Linux appliance deployments
  • Notifications and reports according to edition
Security note:

API gateway controls do not replace application authorization. For example, preventing broken object-level authorization generally requires application-specific identity and object-permission context. CORS is a browser policy—not an authentication mechanism.

DEPLOYMENT CHOICE

Choose the operating model
that fits your team.

Use Windows when you need local reverse-proxy protection plus host security. Use Linux when you need a self-managed gateway that can serve multiple tenants.

Designed around deployment realities

PortWall's editions share a security platform direction while adapting enforcement and licensing to the operating environment.

  • Self-managed deployment options
  • Edition-based feature entitlements
  • Core-based licensing for Linux
  • Per-server licensing for Windows