Yes. Seravo uses a Web Application Firewall (WAF) to monitor and filter web traffic across all client environments. The firewall inspects incoming HTTP/HTTPS requests and automatically blocks known attack patterns—such as SQL injections, Cross-Site Scripting (XSS) attempts, and automated malicious bots—before that traffic can reach WordPress.
Security at Seravo operates on two distinct levels:
Global protection: All sites on Seravo’s servers are automatically shielded against common web threats with centralized security rules.
Site-specific WAF: Individual sites can have more granular, site-specific rule enforcement enabled, which you can manage directly from the command line.
Prerequisites
SSH access to the site for running command-line tools.
Managing WAF Settings via the Command Line (srv)
You can manage your site-specific Web Application Firewall directly from the server using Seravo's built-in srv command-line tool. This is particularly useful during troubleshooting if you suspect the firewall is inadvertently blocking legitimate traffic (false positives), such as external webhook requests.
Check WAF status:
srv feature waf --status
Enable WAF:
srv feature waf --enable
Temporarily disable WAF:
srv feature waf --disable
View tool help and options:
srv feature waf --help
Note on configuration delay:
When you update WAF settings from the command line, the change does not take effect instantaneously. The nginx server reloads the new configuration automatically in the background, which may result in a brief delay before the change becomes active. If you require the change to take effect immediately for urgent troubleshooting, please reach out to Seravo customer support.
When Should You Disable the WAF?
The WAF is designed to stay permanently active to protect your site. However, strict firewall rules can occasionally trigger false positives in specific scenarios, such as:
An external service (such as an ERP system, CRM, or payment gateway) transmits unusually structured or large payloads to the WordPress REST API.
Testing new API endpoints and complex payloads during active development.
If API requests return an error (such as HTTP 403 Forbidden), you can temporarily disable the WAF (srv feature waf --disable). If the request succeeds afterward, a firewall rule is the likely cause. We recommend re-enabling the WAF once testing is complete and contacting our customer support so we can help set up targeted allowlist rules or exceptions for your integration.
Enterprise WAF: Advanced Protection for Demanding Environments
COMING SOON: For WP Enterprise sites, we offer an expanded Enterprise WAF security package that provides deeper visibility and granular control over web traffic:
Custom security rules: Tailored firewall rules specifically tuned to your site’s unique traffic patterns and third-party integrations.
Detailed log data: Comprehensive access to filtered traffic logs, streamlining attack analysis and integration troubleshooting.
Advanced filtering: Stricter security policies optimized for high-profile sites and mission-critical web applications.
If you are interested in Enterprise WAF solutions or would like to discuss your site's specific security requirements, please contact your dedicated account manager or our customer support team.
Please note that this service is coming soon and is not yet available.
See Also
The Web Application Firewall is an essential component of Seravo's multi-layered defense architecture, blocking malicious traffic before it can strain server resources or impact your site. If you suspect the firewall is blocking legitimate requests or need custom rules configured for an integration, our support specialists are always ready to assist at [email protected].