# Configure the web application firewall (WAF)

The WAF blocks common attacks (SQL injection, XSS, bad bots) before they reach your site.

## Steps

1. Go to **Websites → [site] → Firewall**.
2. Set the **mode / paranoia level** — higher levels block more but can occasionally flag legitimate requests.
3. Add **IP or URL bypass** rules for trusted sources or paths that get false-positived.
4. Save. Monitor for a while after raising the level.

## Troubleshooting

- **Legitimate action blocked** (e.g. saving a long post) — add the URL or your IP to the **bypass** list, or lower the paranoia level.
- **Still seeing attacks** — combine the WAF with strong passwords, updates, and the security tools on the **Security** page.

**Related:** Run a malware scan and clean an infection · Manage plugins, themes & WordPress core