How to install the SecureWeb Website Firewall
One command puts the firewall in front of your website. This guide shows what your server needs, what the command changes, how to check it worked and how to undo it, whether you run it yourself or hand it to your developer or your AI assistant.
Using an AI assistant? Give it the same guide in Markdown, written for it to follow.
Who does what
- You sign in with Google At app.secureweb.ma. No card is asked for.
- You add your website and copy its install command The command carries a token that works once and lasts 30 minutes.
- Someone runs the command on your server You, your developer, or an AI assistant with root access to the server. It takes about a minute.
- You read a day of the security log, then switch blocking on The firewall starts by only watching, so you see what it would block before it blocks anything.
Steps 1, 2 and 4 happen in your dashboard, which needs your Google sign-in. An AI assistant can’t do them for you.
What your server needs
- Linux with systemd, on x86-64 or ARM64: Ubuntu 18.04 or newer, Debian 10 or newer, or AlmaLinux and Rocky 8 or newer
- Root access: the command runs with
sudo curl,grep,sha256sum,openssl1.1.1 or newer, andssornetstat- Your website served from that server by nginx or Apache, with or without HestiaCP, Plesk or cPanel
- Outbound HTTPS to app.secureweb.ma and agent.secureweb.ma
It doesn’t work on shared hosting, Wix or Shopify, or with other web servers such as LiteSpeed or Caddy. Websites behind Cloudflare work: the firewall reads each visitor’s real address from Cloudflare.
Check a server before you make a token
Each of these commands only reads. Run them on the server that hosts your website:
uname -sm . /etc/os-release && echo "$PRETTY_NAME" command -v systemctl curl grep sha256sum openssl command -v ss || command -v netstat openssl version systemctl list-units --type=service --state=running | grep -E 'nginx|openresty|apache2|httpd' ls -d /usr/local/hestia /usr/local/psa /usr/local/cpanel 2>/dev/null
You should see Linux on x86_64 or aarch64, a path for each of the five commands, openssl 1.1.1 or newer, and nginx or Apache running. The last line names your control panel, if you have one.
Install
Your dashboard shows the command with your website’s own token. Run it on the server that hosts the website:
$ curl -fsSL https://agent.secureweb.ma/install.sh | sudo bash -s -- --token YOUR-TOKEN
- The token works once and expires after 30 minutes. “Generate a new command” in the dashboard makes another.
- It takes about a minute, and asks no questions when it is run like this.
- When it succeeds, it prints “your domain is now behind SecureWeb.”
Prefer to read the script first? Download it, read it, then run it. Run this way, it asks once before it changes anything.
curl -fsSL https://agent.secureweb.ma/install.sh -o secureweb-install.sh
less secureweb-install.sh
sudo bash secureweb-install.sh --token YOUR-TOKEN
What the command does
- Installs the firewall It downloads it, checks it against the list of builds SecureWeb signed, and tests it on your server.
- Registers your server The token tells it which website to protect.
- Works out how your website is served If nginx sits in front of a backend, as on most control panels, the firewall slots in behind nginx, which keeps ports 80 and 443. If nginx or Apache serves the website directly, the firewall takes ports 80 and 443 with your website’s own certificate, and the web server moves to internal ports behind it.
- Backs up every file it will change The copies are kept in
/etc/secureweb/backup. - Puts the firewall in front of your website Nothing in your web server’s configuration changes before this step.
- Checks your website still works It loads your home page and login page through the firewall and compares them with before. If anything differs, it undoes everything by itself.
It leaves the firewall in /usr/local/bin, its settings in /etc/secureweb and its cache in /var/lib/secureweb-agent, with a systemd service named secureweb-agent and a daily update timer.
Check that it works
curl -sI "https://your-domain/?secureweb-check=$(date +%s)" | grep -i '^x-secureweb'
systemctl status secureweb-agent
X-SecureWeb: active means the request went through the firewall. The extra part of the address makes sure a CDN doesn’t answer from a copy it saved earlier. Your dashboard shows the website as connected within seconds.
Blocking starts switched off. Every new website starts in monitor-only mode: the firewall records what it would have blocked and lets the request through, so installing it can’t turn a real visitor away. From the first minute it refuses only your own rules, such as your block list, and files no visitor should ask for, like database dumps, backups and keys. Read a day of your log, then switch blocking on in your dashboard.
Undo or remove it
Undo the installation. The firewall stops, and your web server is served exactly as before:
curl -fsSL https://agent.secureweb.ma/install.sh | sudo bash -s -- --rollback
Undo one website and keep the others on the server protected:
curl -fsSL https://agent.secureweb.ma/install.sh | sudo bash -s -- --rollback --site your-domain
Remove SecureWeb completely. This restores your web server’s configuration and deletes the firewall, its files and its timers. It needs no account:
curl -fsSL https://agent.secureweb.ma/uninstall.sh | sudo bash
Options
Add these to the end of the command. Most installations need none of them.
| Option | What it does |
|---|---|
--token token | The installation token from your dashboard. |
--mode sidecar or frontend | Chooses how the firewall sits instead of detecting it. sidecar: behind your nginx, which keeps ports 80 and 443. frontend: on ports 80 and 443, with the web server moved to an internal port. |
--upstream address | Where to send the website’s traffic, instead of the detected backend, for example https://127.0.0.1:8443. |
--yes | Doesn’t ask for confirmation. |
--rollback | Undoes the installation and restores your web server’s configuration. |
--site domain | With --rollback, undoes only this website. |
--refresh | Brings the updater and service files up to date on a server that already runs SecureWeb, without touching the website. |
--help | Lists the options. |
If the installer stops
It says why, and whether anything was changed. These are the usual reasons:
| The message says | What to do |
|---|---|
| This installer must run as root | Run it with sudo, or ask someone who has root on the server. |
| Required command … is not installed | Install that package, then run the command again. |
| openssl … is too old | The server needs openssl 1.1.1 or newer to check SecureWeb’s signature. |
| The token may have expired | Tokens last 30 minutes and work once. Make a new command in your dashboard. |
| Could not find any nginx configuration for … | nginx serves your website under another name or from another folder. If nginx sends it to a backend, run again with --mode sidecar --upstream and that backend’s address. |
| Moving the whole web server onto an internal port would take the others offline | One web server serves several websites directly. Use --mode sidecar --upstream if nginx sends this website to a backend. If nginx serves it with PHP-FPM, contact us and we’ll set it up with you. |
| Installation rolled back | Your website didn’t answer the same way through the firewall, so everything was put back. Send us the full output and we’ll sort it out. |
Updates
The firewall updates itself once a day, and you can update it from your dashboard too. Every build is signed with a key SecureWeb’s servers never hold, and your server checks that signature before it installs anything. A new build must pass a test on your server first, and the previous one comes back by itself if the new one doesn’t serve your website.
sudo secureweb-agent-update --check # what would happen, nothing changed sudo secureweb-agent-update # update now sudo secureweb-agent-update --rollback # back to the previous build
Questions
Can my AI assistant install it for me?
Yes, if it can run commands as root on your server. You sign in, add your website and give it the install command. It can check the server, run the command, check the result and undo it. It can’t sign in to your dashboard for you, so never give it your Google password.
Do you need access to my server?
No. You, or someone you choose, run the command, and the firewall connects out to your dashboard. We never ask for your server’s password.
Can I protect several websites on one server?
Yes, when nginx sits in front of them, as on HestiaCP, Plesk or cPanel. Run each website’s own command on the same server. One firewall protects them all, and each website keeps its own settings and history.
What if SecureWeb’s servers can’t be reached?
Your website doesn’t depend on them. The firewall keeps working with the settings saved on your server, and keeps its log until it can send it.
What if the firewall itself crashes?
It is restarted within two seconds. If it can’t start at all, your server takes it out of the way and puts your web server back as it was, so your website keeps answering, and your dashboard and an email tell you.
What happens when the free trial ends?
Your website keeps working. The firewall stays in place and keeps the rules you set yourself, such as a password on your admin pages; automatic attack blocking pauses until you choose a plan. The plan is $20 a month or $199 a year for each website.
Try it free for 30 days
No card, nothing to sign. If it isn’t for you, one command removes it.
Questions? Contact us