Learning Hub · Advanced · 15 minutes
How to Set Up a Firewall With UFW
Default-deny protection in five commands — a practical, no-jargon walkthrough with the classic mistake flagged before you make it.
The short answer
Goal: default-deny protection in five commands. Time needed: 15 minutes. Difficulty: advanced.
Below: the exact steps, the classic pitfall, and a pro tip from the support desk. Where our platform automates a step, the guide says so rather than making you do robot work.
Advanced
Difficulty
15 minutes
Time needed
5
Steps
24/7
Help if you're stuck
This guide assumes no prior expertise — just a hosting account, a browser, and 15 minutes of attention. Every instruction works on our platform exactly as written, and translates to any standard cPanel host.
One promise before starting: nothing in this guide is irreversible. Where a step could bite, we say so and give the undo.
The route map
Here's the complete route: set the default stance, allow ssh before enabling, open the service ports, enable and inspect and rate-limit the sensitive ports.
Each stage is a few minutes of focused clicking — the elapsed time mostly depends on how familiar the control panel already feels. The detailed steps are listed further down this page; skim the whole route once before starting.
Where this goes wrong (and how to not)
Ufw enable before allowing SSH — the firewall performs its duty flawlessly, the session survives until disconnect, and the reunion requires console access; allow-then-enable is the sacred order.
Forewarned is genuinely forearmed here — this exact mistake accounts for most of the frustration this topic produces, and it's entirely avoidable once named.
One habit that makes this easier forever
The status output doubles as documentation — if a port in the list makes you ask 'why is that open', the firewall just performed its second function: making the server's surface legible.
It costs a minute now and repays it every time this task comes around again — which, like most hosting tasks, it will.
What's automated here
Several steps in this guide exist because hosting historically made you do them — on our plans, SSL issues itself, backups run daily without being asked, and one-click installers replace manual setup entirely. What remains is the genuinely-yours part of the task.
And when a step misbehaves anyway, support answers around the clock — with the actual fix, not a knowledge-base link and a shrug. Half our best guides started as patterns in the tickets.
The platform this guide assumes
Every walkthrough in our Learning Hub is tested on the platform we actually run — cPanel, LiteSpeed, NVMe, one-click installs — so instructions match your screen instead of gesturing at it.
Support is answered by real people around the clock — including the questions other hosts call out of scope.
- Step-by-step, tested as written
- The gotcha flagged before you hit it
- Automation covers the boring steps
- 24/7 support if you get stuck
Why HostingAlly
What you get with every plan
Help on standby
Stuck at step three at midnight? Support answers around the clock, mid-guide included.
Works as written
Every step tested on our own platform — no 'your host may vary' hand-waving.
Written from real tickets
Our guides come from the support desk — the gotchas are the ones people actually hit.
The undo is always named
Where a step could bite, the guide says so and gives the reversal.
Automation where it belongs
SSL, backups and installs run themselves here — the guide covers only what's genuinely yours to do.
No jargon tax
Terms are explained in place or linked to the glossary — nothing assumes you already know.
Getting Started
How to get going
- 1
Set the default stance
ufw default deny incoming; ufw default allow outgoing — everything inbound is refused unless explicitly invited; the posture that makes the rest simple.
- 2
Allow SSH before enabling
ufw allow 22/tcp (or your custom port) before ufw enable — the ordering that determines whether you secured the server or evicted yourself.
- 3
Open the service ports
80 and 443 for web, plus whatever the server genuinely serves — each allow line is a deliberate decision, which is the point.
- 4
Enable and inspect
ufw enable, then ufw status verbose — the rule list should read as a complete inventory of what this server offers the internet.
- 5
Rate-limit the sensitive ports
ufw limit on SSH throttles repeated connection attempts — the built-in brute-force damper that costs nothing.
Included
What's covered on our plans
- Free domain for the first year on annual plans
- Free SSL certificate on every plan, renewed automatically
- Renewal prices that match signup prices
- Free website migration handled by our team
- 99.9% uptime commitment, monitored around the clock
- NVMe SSD storage as standard
- One-click installer for WordPress and 400+ apps
- cPanel — the industry-standard control panel
- No setup fees, ever
- SSH, Git and Composer access on developer-friendly plans
FAQ
Your questions, answered
Do I need ufw if my provider has network protection?
Yes — DDoS mitigation absorbs volumetric attacks; the host firewall controls which services are reachable at all. Different layers, both load-bearing; the five-command setup is among security's best effort-to-value ratios.
How do I allow a service only from my own IP?
ufw allow from your.ip.address to any port 22 — source-restricted rules for admin services shrink the exposure to a single address. Pair with a fallback plan for when your IP changes (VPN, or the provider console).
How long does it take to get started?
Minutes — hosting activates on payment, the domain (free for year one on annual plans) connects immediately, and one-click installers put WordPress or 400+ other apps live the same sitting. If you have an existing site, our team migrates it free, usually within 24 hours.
Where is your company based?
HostingAlly is a trading name of Bohzo Ltd, a company registered in England and Wales — a real, verifiable business with published terms under English law, which is worth checking about any host before you hand them your domain.
What does your 24/7 support actually cover?
Real people at every hour, and a scope that includes the practical questions — email setup, DNS, WordPress issues, restores — not just 'the server is up, ticket closed'. Pre-sales questions are welcome too; ask us something difficult and judge the reply.
Do you include email with hosting?
Yes — mailboxes on your own domain come with every hosting plan, with webmail, IMAP/POP/SMTP access and spam filtering. Standalone email hosting also exists for domains whose websites live elsewhere.
Are backups included, and can I restore them myself?
Daily automatic backups are standard, restorable from the panel in minutes — files, databases or both, at 3am without a ticket if that's when you need it. For extra cover, you're welcome to run your own offsite copies alongside.
Keep exploring
How to Edit DNS Records
Add and change A, CNAME, MX and TXT records without breaking anything — beginner level, 5 minutes per record.
How to Add Google Analytics
Measure your audience with consent handled properly — beginner level, 30 minutes.
VPS Hosting
KVM virtual servers with root access, DDoS protection and flat pricing.
Web Hosting
NVMe cPanel hosting with free SSL, migration and a free first-year domain.
Ready when you are.
Every plan includes the essentials others sell as extras — and support that actually answers.
See Hosting Plans