A WooCommerce store handles customer data, payment details, and order information every day. That makes it a frequent target for bots, SQL injection attempts, and brute-force login attacks. A web application firewall filters this traffic before it reaches your store. This guide walks through enabling a WAF for WooCommerce.
How to Secure WooCommerce with a WAF?
Step 1: Sign In to cPanel
Sign in to cPanel with the URL, username, and password your host issued at signup. Your host emailed these the day the account was created.
Step 2: Go to the Security Section
Open your cPanel dashboard and look under the Security section. The ModSecurity icon appears among the tools listed there.
Step 3: Open ModSecurity
Click on the icon. cPanel lists every domain tied to your account, each with its own on/off switch.
Related Read: How to Enable WAF in cPanel?
Step 4: Pick the Right Domain
Your account may host several websites. Your WooCommerce domain appears somewhere in that list. Read the name carefully before clicking anything; one wrong toggle affects a different website entirely.
Step 5: Turn the Firewall On
Click the switch next to your domain to move it from Off to On. There’s no save button; the change takes effect right away.
Step 6: Test Your Checkout Flow
Certain default ModSecurity rules occasionally flag legitimate checkout or payment gateway requests as suspicious. Walk through a test purchase in your store after turning the firewall on. A blocked step during checkout usually points to one specific rule causing the issue.
Step 7: Reach Out If Something Breaks
A blocked checkout request means it’s time to contact your host’s support team. Don’t turn the firewall off to resolve it. Most hosts can whitelist that one rule without exposing the rest of your store.
Step 8: Add Login Protection
WordPress login pages on WooCommerce websites draw constant brute-force attempts from bots trying random password combinations. A login limiter plugin blocks an IP address after several failed attempts. Some hosts also offer this protection at the server level, which works without installing anything on your store.
Step 9: Confirm It’s Working
Return to the ModSecurity page and hit refresh. Your domain now shows “On” next to it if the firewall is running. Place one more test order to confirm checkout still works.
A Few Important Considerations
A WAF stops a large share of automated attacks before they ever reach your WooCommerce store, but it works best paired with strong passwords, regular plugin updates, and SSL on every page. Check your checkout flow after any firewall change, since payment steps are the part most likely to get flagged by mistake.
