How to Manage Security for Your Cloudways Velocity Application

The Security section in Cloudways Velocity provides tools to review suspicious activity and protect your application from unwanted access, harmful files, and unsafe traffic.

From this section, you can:

These security tools use Imunify360 technology to help identify suspicious activity, control access, and protect applications from malicious files and requests.

Before you begin, make sure that:

The Velocity Security section gives you a single location to review security alerts, investigate suspicious requests, manage access rules, check domain reputation, and enable Malware Protection.

Review each event before taking action. Careful use of IP rules, country blocking, and malware protection can improve security without interrupting legitimate users or connected services.

Shows the total number of security alerts recorded during the selected period.

An alert means that the security system detected an event that may require review. An alert does not always mean that the application was successfully attacked.

Shows events in which suspicious visitors were presented with a security verification screen before they could continue.

This check helps distinguish normal visitors from automated or suspicious requests.

Shows the number of harmful or infected files cleaned by the security system.

Shows how many malware threats were found during the selected period.

Malware is harmful code or a file designed to damage, change, misuse, or gain unauthorized access to an application.

Shows suspicious activity detected at the network or server access level.

This can include repeated unauthorized access attempts or other activity that matches known attack patterns.

The table displays the following information:

Shows when the incident was recorded.

The displayed time may use UTC. Consider the time difference when comparing an incident with your local records.

Shows the IP address connected to the detected activity.

An IP address identifies the device, service, or network that sent the request.

Shows how many related events were recorded.

Provides a brief description of the suspicious activity detected by the security system.

Shows the estimated importance of the event, such as Medium.

Severity helps you prioritize incidents, but it should be reviewed together with the event details, frequency, and source IP.

Provides options to add the IP address to the allow list or block list.

Confirm the action when prompted. Cloudways security controls also allow IP addresses to be moved between allowed and blocked states directly from recorded incidents.

If an issue is detected, the table may display:

From this page, you can:

Cloudways firewall controls support custom rules for IP addresses, IP ranges, and country-based blocking.

Shows the IP address or IP range covered by the rule.

Shows whether the IP is allowed or blocked.

TTL means Time to Live. It shows how long a temporary firewall rule remains active.

When the TTL expires, the rule is removed automatically.

Shows the country connected to the IP address.

Explains why or how the rule was added, such as an automatically allowed IP.

Provides available controls for the selected rule, such as deleting it.

You can locate an existing rule in two ways.

Enter the IP address in the Search by IP field.

Select Refresh to retrieve the latest rules.

Use a custom IP rule to allow or block a particular IP address or IP range.

CIDR is a standard way to define a group of IP addresses. For example, a CIDR range can apply one rule to an entire network instead of a single address.

Leave the TTL empty when the rule should remain active until it is manually removed.

Allows the entered IP address or range.

Blocks the entered IP address or range.

Optional: Enter a clear description in Add Comment.

For example:

Office IP — allowed for application administration

Country blocking prevents incoming requests from selected countries from reaching your application.

The protection shown in the Platform may include:

Helps detect and block harmful pages or code designed to steal passwords or other private information.

Helps protect the application environment from harmful activity.

Checks for harmful content inserted into the application database and cleans supported threats.

Automatically cleans supported infected files after malware is detected.

Checks application activity while it runs and blocks supported malware actions before they complete.

Does a security incident mean that my application was compromised?

No. An incident means that suspicious activity was detected. The security system may have blocked the request before it affected the application.

What is the difference between allowing and blocking an IP?

Allowing an IP permits its requests to reach the application. Blocking an IP prevents its requests from reaching the application.

Should I block every IP shown in the Incidents section?

No. Some incidents may be caused by automated scans, shared networks, trusted services, or incorrectly identified requests. Review the event before blocking the IP.

What happens when a firewall TTL expires?

A rule with a TTL is removed automatically when the selected time ends.

Can I block several countries at the same time?

Yes. The country rule allows you to select more than one country before applying the block.

What should I do when my domain is reported as unsafe?

Review your Malware Protection results and application logs, remove harmful content, change exposed credentials, and inspect recent application changes. You may also need to request another review from the service that reported the domain.

Does Malware Protection replace application security practices?

No. Continue using strong passwords, secure authentication, restricted access, safe application code, current dependencies, and regular backups.

What should I do if trusted users cannot access the application?

Check the Incidents and Firewall sections to confirm that their IP address or country was not blocked. Remove or update the incorrect rule after confirming that the access is legitimate.

That's it! We hope this article was helpful.