Reverse-proxy WAF
Inspect web requests before they reach the origin application.
- HTTP/S request inspection
- Rules for common web attacks
- Monitor and blocking modes
- Site-aware policy tuning
WINDOWS SERVER · IIS · HOSTING PROVIDERS
Protect the application.
Protect the host.
PortWall for Windows combines local reverse-proxy application security with host-oriented protections for Windows Server environments, including web hosting and IIS deployments.
WINDOWS SECURITY STACK
A layered defense for
Windows-hosted applications.
Place application inspection in front of IIS and complement it with host security controls configured for your environment.
Host intrusion protection
Extend protection beyond HTTP/S traffic into supported Windows services and event sources.
- Brute-force controls for supported RDP, SMB, SQL Server, mail and application logins
- Event and log-driven detection where configured
- Time-bounded blocking policies
- Administrative allowlist safeguards
Malware and file security
Use host-side controls to reduce risk from suspicious files and webshell activity.
- Malware scanning integration
- Webshell detection where enabled
- File integrity and quarantine capabilities where supported
- Upload policy controls
Bot defense
Available in Premium and Enterprise editions to help identify and control unwanted automated traffic.
- Traffic and TLS fingerprint signals where supported
- Rate limits and mitigation policies
- Verified crawler policy options
- Cross-tenant campaign correlation where enabled
API security in Enterprise
Apply dedicated API checks for services that need schema-aware or token-aware validation.
- API specification checks
- JWT validation
- CORS checks and policy enforcement
- GraphQL query/resource limits
Hosting operations
Designed for service providers managing many sites and application instances.
- Site onboarding and routing workflows where supported
- Certificate integration and management features as configured
- Original visitor IP preservation support
- Central policy visibility and alerts
WINDOWS EDITIONS
Three tiers.
A clear upgrade path.
Each tier is licensed per Windows server.
STANDARD
Core protection
$49/server/mo
or $490/year 2 months free
WAF and Windows host security, with threat intelligence, geo blocking and upload file inspection.
- Web application firewall
- Windows host security
- Threat intelligence
- Geo blocking
- Upload file inspection
PREMIUM
POPULARIntelligence + bot defense
$99/server/mo
or $990/year 2 months free
Everything in Standard, plus premium threat intelligence, herd immunity and bot protection.
- Everything in Standard
- Premium threat intelligence
- Herd immunity
- Bot detection & protection
ENTERPRISE
Application + API defense
From $199/server/mo
or from $1,990/year 2 months free
Everything in Premium, plus API protection.
- Everything in Premium
- API specification checks
- JWT validation and CORS controls
- GraphQL limits and related API security
ROLLOUT APPROACH
Observe first.
Enforce with confidence.
Applications can behave differently in production. A staged rollout helps teams understand detections and tune policies before enabling blocking broadly.
1
Deploy and observe
Start with the appropriate monitor mode and capture representative application behavior.
2
Review and tune
Investigate detections and apply narrow exceptions when a rule interferes with legitimate traffic.
3
Enable enforcement
Move suitable policies to blocking and continue reviewing events as applications change.
Typical fit
- Windows hosting providers and MSPs
- IIS-hosted business applications
- Multi-site Windows servers
- Organizations that need web and host controls together
Deployment note: actual compatibility depends on Windows Server version, control panel, network layout and enabled modules. Validate your environment during onboarding.
Discuss your deployment →