Web application firewall

On all Linux web hosting servers, a web application firewall (WAF) protects your website. It checks every request before it reaches your website and blocks typical attacks, for example on security vulnerabilities in PHP, WordPress, plugins and other software. This also works when a vulnerability is still unknown or no update is available yet. The WAF is managed by FireStorm, continuously supplied with new rules and always switched on.

Why can’t I switch off the WAF?

Many websites share one server. If an unprotected website is attacked, this can also endanger the other websites on that server. That is why the WAF in the hosting management (Plesk) cannot be switched off or set to «Detection only», and individual rules cannot be removed. Under Websites & Domains > your domain > Web Application Firewall you see this notice instead:

What can I do if the WAF blocks my website?

Occasionally a rule also blocks a harmless request, for example when saving a form or in the admin area of your CMS. You usually recognise this by the error message «403 Forbidden» or «Access denied».

1. Note the address (URL) of the page as well as the date and time.
2. Open a ticket at https://admin.firestorm.ch/submitticket.php and state the domain, the URL and the time.
3. We check the report. If it is a false alarm, we exclude exactly this one rule for your website. The rest of the protection stays active.

Frequently asked questions

Does the WAF make my website slower?
No, checking a request usually takes only a few milliseconds.

Do I still need updates?
Yes. The WAF is an additional protection, but it does not replace updates. Keep your CMS, your plugins and your PHP version up to date.

Can I switch off the WAF briefly for a test?
No. Please open a ticket instead, we will find the blocking rule and exclude it for your website if necessary.