Walkthrough · Intermediate · 20 minutes
How to Set Up a Firewall with UFW
Get default-deny filtering running without locking yourself out of the machine — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
The job: get default-deny filtering running without locking yourself out of the machine. Time to set aside: 20 minutes. Skill needed: intermediate.
Below are the precise steps, the classic stumble, and one tip from the support desk. Wherever the platform already does a step for you, the guide says so rather than handing you a machine's chores.
By the Hosting & Domains team · Reviewed 18 August 2026
Intermediate
Experience required
5
Stages, start to finish
Free
Support included
Proven
On the platform itself
No prior knowledge assumed — a hosting account, a browser and 20 minutes of attention is the whole entry requirement. Every instruction runs on our platform exactly as printed, and carries over to any standard cPanel host.
A promise before step one: nothing here is a one-way door. Any step with teeth is flagged, and the way back is printed beside it.
The route, mapped end to end
Set out end to end, the route is: allow ssh before anything else, set the default policy, open the services you genuinely run, enable it and read the status and test it from somewhere else.
Every stage is a few minutes of unhurried clicking — the total depends mostly on how well you already know the control panel. The detailed instructions are further down; read the whole path once before you begin.
Where it comes off, and how to stay on
Bringing the firewall up over SSH before the SSH rule exists. Your connection dies halfway through a command and the server goes on blocking you quite contentedly. Add the rule, see it in the status output, and enable only then.
Forewarned is genuinely forearmed here. This one mistake accounts for most of the frustration the topic ever causes — and it disappears entirely once somebody points it out.
The habit that keeps this easy for good
Wherever it is possible, tie a rule to a source address. Letting your office address reach the database port opens it to one place rather than to the whole internet, which is the difference between a considered exception and an open door.
A minute spent now repays itself every time this job comes round again — and like almost every hosting job, come round it will.
The parts that look after themselves here
Some steps in this guide exist only because hosting traditionally forced them on you. Here the SSL issues itself, the copy is taken daily without being asked, and one-click installers remove the manual setup. What is left is the part that was always genuinely yours.
Should a step still misfire, support answers at any hour with an actual fix rather than a knowledge-base link and a shrug. Half the guides on this site began as repeat patterns in our ticket queue.
The hosting these steps were tested on
Every walkthrough in this library is run on the platform we actually operate — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen rather than gesturing at it from a distance.
A free SSL certificate comes with every plan and reissues itself before the old one lapses — the padlock is never yours to diarise.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
The snag, flagged up front
The classic error for this particular task is named before step one, which is how 20 minutes stays 20 minutes.
The dull parts automated
SSL, backups and installs look after themselves here, leaving the guide to cover only what is genuinely yours.
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
Every undo written out
Any step that could bite is marked, together with the exact way to wind it back.
Taken from real tickets
These guides came out of the support queue, so every snag flagged is one people genuinely hit.
Jargon never charges you
Every term is defined on the spot or linked to the jargon buster — nothing assumes prior knowledge.
Quick Start
Order placed to site online
- 1
Allow SSH before anything else
Permit OpenSSH, or the port number if you have moved it. This is the rule that must exist before the firewall is switched on, because enable first and your own session is the first casualty.
- 2
Set the default policy
Deny incoming, allow outgoing. Inbound access becomes a short explicit list you can read at a glance, while outbound stays open so updates and API calls keep working normally.
- 3
Open the services you genuinely run
Ports 80 and 443 for a web server. Resist opening database or admin ports to the world, since those belong on localhost or restricted to one specific source address.
- 4
Enable it and read the status
Bring the firewall up, then print the verbose status. What comes back is now every route into this machine, so read it properly instead of skimming.
- 5
Test it from somewhere else
Open a second terminal and reconnect over SSH, then load the site on a phone that is off your own network. Rules that look right locally still need proving from outside.
Built In
Fitted to every plan
- cPanel, which is what most of the industry already runs
- 99.9% uptime as the target, watched around the clock
- SSH, Git and Composer on the developer plans
- PHP versions set per site from the control panel
- Free SSL on every plan, reissued before the old one lapses
- DDoS filtering absorbed at the network edge
- Your existing site brought across by our engineers, at no charge
- No set-up charge at any point, and no joining fee
- NVMe SSD storage on every tier, not only the dear ones
- A renewal figure identical to the one you registered at
Frequently Asked
The questions that come up most
Is a firewall enough on its own?
Which ports can be reached is what it governs, and that is a large part of the problem and the easiest part to get right. For a vulnerable application on a port you opened on purpose, it does nothing whatever. Put patched software beside it, fail2ban too, and for web traffic a WAF that reads the requests themselves.
Will a firewall slow the server down?
At ordinary volumes, not measurably, since packet filtering is cheap and runs in the kernel. A flood is what genuinely costs performance, and that is absorbed by the network-level DDoS protection in front of our VPS platform long before it meets your rules.
Will you move my existing site free of charge?
Yes. Open a ticket with the login for your current host and we bring the lot across — files, databases, mailboxes, configuration. You check the copy before DNS moves, and the old site keeps taking traffic right up to the moment the new one serves it, so nobody meets a gap.
If I cancel, what becomes of my site and files?
They remain yours. Download a full copy from the panel whenever you like, before or during cancellation. Names stay registered in your name for the term you paid for and can move to any registrar once the standard 60-day window has passed.
Keep reading
How to Connect a CDN
Serve assets from close to your visitors, in the cases where that genuinely pays — intermediate level, about an hour.
How to Add an Addon Domain
Host a second site on the same account while keeping the pair cleanly separated — beginner level, about 10 minutes.
WAF (Web Application Firewall) (Glossary)
The full definition, along with the practical consequence nobody bothers to mention.
Web Hosting
cPanel hosting on NVMe drives — SSL, the migration and year one of the name all included.
Secure Hosting
Imunify360, isolated accounts and hardened defaults for security-first builds.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
Your site has earned better hosting.
NVMe hosting with SSL and the migration included, people answering at any hour, and a price that stays where it was.
View Web Hosting plans