Home/Features/Website firewall
security Module

Website firewall

The WAF runs on the Nginx edge. It blocks SQL injection, XSS, path traversal, sensitive files, and scanners. Set IP, user-agent, and URL blacklists and whitelists, plus country rules. Apply connection limits, rate limits, and an Under Attack browser check. Behind Cloudflare, the panel uses the real visitor IP.

In the October 2026 product

Interface Preview

Designed for Speed and Granular Control

BoltPane // Website firewall
status: OK
WAF

SQL injection, XSS, path traversal, sensitive files, and scanner blocking.

Lists

IP, user-agent, and URL blacklists and whitelists, plus country rules.

Limits

Connection limits, rate limits, and an Under Attack browser check.

Visibility

Attack map, top attackers, visited pages, and visitor IPs.

Workflow

How Website firewall Operates Under the Hood

Direct daemon interaction without bloated intermediate database abstractions.

01. Configuration

Direct System Templating

Applies standard Linux configurations directly to service directories (/etc/nginx, /etc/php, /etc/systemd).

02. Execution

Isolated Security Boundary

Commands run under strict POSIX jail and user separation without exposing global root credentials.

03. Telemetry

Live Status Verification

Immediately checks systemd exit codes and tests socket availability to confirm zero downtime.

Ready to use Website firewall?

BoltPane is 100% free with no license keys or trial limits. Download and run the install script on your Linux VPS.