A firewall is a filter that blocks malicious traffic before it reaches your site or server.
A firewall sits between your server and the internet and decides which traffic is allowed through. It checks each connection or request against a set of rules. Traffic that looks normal passes. Traffic that matches a known attack, comes from a blocked address or tries to reach a closed port is dropped.
For example, if a bot tries thousands of passwords on your WordPress login page in a few minutes, a firewall can spot the pattern and block that IP address before it gets lucky.
How a firewall works
Firewalls apply rules at different levels:
- By address: allow or block traffic from specific IP addresses, ranges or countries.
- By port and protocol: only open the ports a server needs, such as 443 for HTTPS and 22 for SSH, and close the rest.
- By behaviour: block clients that make too many requests or failed logins in a short time.
- By content: inspect the request itself for signs of attacks, such as SQL injection or malicious file uploads.
Types of firewall
- Network firewall: works on connections and ports. It's the first line of defence for a server.
- Web application firewall (WAF): understands web requests and blocks attacks aimed at websites, like exploits against vulnerable plugins.
- Cloud firewall: runs at a CDN or proxy service before traffic reaches your host.
- Plugin firewall: runs inside your application, such as a WordPress security plugin. It's easy to set up but only works after PHP has started, so it uses more of your account's resources.
Many sites use more than one layer, such as a server-level firewall plus a CDN.
Why a firewall matters for your website
Websites are scanned by automated bots constantly. Most attacks aren't personal. They look for any site running an old plugin, a weak password or a known bug. A firewall stops much of this before it can do damage, reduces wasted server resources and buys you time to apply updates when a new vulnerability is announced.
Common firewall problems
- False positives: a rule blocks a real visitor or a legitimate action, such as saving a page with unusual code in it. The fix is to whitelist the address or adjust the rule, not to switch the firewall off.
- Blocking yourself: too many failed logins from your office can block your own IP.
- Relying on it alone: a firewall doesn't replace updates, strong passwords, two-factor authentication or backups.
Every AblePage plan includes Imunify360, which combines a server-level firewall with malware scanning.