A Magento store handles customer accounts, saved payment methods, and order history every single day. That combination draws bots, brute-force login attempts, and SQL injection attacks more than most website types. A web application firewall filters this traffic before it ever reaches your store. This guide covers the steps to activate a WAF for your Magento store.
What are the steps to secure a Magento store with a WAF?
Step 1: Sign In to cPanel
The system sends a URL, username, and password to your inbox on the day of account creation. Use those to sign in to cPanel.
Step 2: Go to the Security Section
Log in, then open the cPanel dashboard. The ModSecurity icon sits under Security, usually near the middle of the dashboard depending on your theme.
Step 3: Open ModSecurity
Click on the icon. cPanel lists every domain tied to your account, each with its own on/off switch.
Step 4: Find Your Store’s Domain
Your account might host more than one website. Please review the list until you identify the domain associated with your Magento store, and take a moment to read the name twice before proceeding.
Step 5: Turn the Firewall On
Click the switch next to your domain to move it from Off to On. There’s no save button; the change takes effect immediately.
Step 6: Walk Through Checkout and Login
Firewall rules occasionally mistake normal Magento activity for something suspicious, especially around checkout, the admin login page, and API calls between extensions. Once the firewall is active, place a test order and log into your admin panel to confirm both still work. If either step stalls or throws an error, one specific rule is usually behind it.
Step 7: Whitelist the blocked rule
A blocked request during checkout or login means contacting your host’s support team, not switching the firewall off. Most hosts whitelist the single rule causing trouble, leaving the rest of your protection intact.
Related Read: How to Secure WooCommerce with WAF?
Step 8: Lock Down the Admin Login Page
Bots test Magento’s admin login around the clock, working through one password combination after another. Where your setup allows it, restrict access to trusted IP addresses. A login limiter adds a second layer, cutting off repeated failed attempts before they can run indefinitely.
Step 9: Recheck the Toggle
Please return to the ModSecurity page and refresh it. Your domain should show it’s active. Run one last test order to confirm the storefront still works smoothly.
A Few Important Considerations
A firewall stops a large share of automated attacks before they reach your Magento store, but it isn’t the only layer worth maintaining. Outdated core files and extensions remain one of the easiest ways in for an attacker, so update both on a regular schedule rather than waiting for a warning. SSL on every page and strong, unique admin credentials complete the basics. None of these steps replace the others; they work together, and skipping one tends to undercut the protection the rest provide.
