HF PanelFirewall rules
Block or allow addresses and countries per website, limit login pages and check suspicious visitors.
The Firewall rules screen decides who may open each of your websites. The rules work in the web server itself, before your website's code runs, so they also protect sites that have no security plugin.
Where: Control Panel › Security › Firewall rules
Pick a website at the top; its parked domains follow its rules.
IP addresses
| Field | What it does |
|---|---|
| Allowed addresses | one address or range per line (198.51.100.7, 203.0.113.0/24, IPv6 too); these skip every other rule below |
| Blocked addresses | visitors from these get 403 Forbidden |
| Only the allowed addresses may open this website | everyone not on the allowed list gets 403 — for a staging site or an admin-only site |
You can't block your own address (the screen shows it under Blocked addresses) unless it is also allowed. Each list takes up to 500 entries.
Countries
Choose countries under Blocked countries and click Add; visitors from them get 403. Country blocking uses the country list your host imports (see Site firewall rules); without one the section says so and blocks nobody.
Login pages
Tick Limit requests to login pages and choose the pages: WordPress login and XML-RPC, Admin areas, Login pages, and any Other paths (a path also covers what starts with it). Requests per minute and visitor sets the limit (5, 10, 20 or 60); a visitor who sends more gets 429 Too many requests for a short while. This slows down password guessing without bothering real people.
Bot protection
| Choice | Who sees the check page |
|---|---|
| Off | nobody |
| Suspicious visitors only | visitors without a browser name or with the name of a script or tool |
| Every visitor (under attack) | everyone without the website's cookie |
The check page shows for a moment, sets a cookie with JavaScript and opens the page again; the cookie lasts a day and only works for that visitor's address. Let known search engine crawlers through keeps your site in search results; Only after checking their reverse DNS stops programs that only pretend to be a crawler (a genuine crawler is let in a few minutes after its first visit).
Click Save rules. The web server tests the new rules before they apply; if it refuses them, the old rules stay.
Note: an allowed address skips the country block, the login limit and the check page.
Refused requests
Under the form you see how many requests were refused (by reason), the Most refused addresses (with Block to add one to the blocked list at once), the Most refused pages and the Latest refused requests.