# WordPress, applications and WAF > The client panel's WordPress Manager, Applications and WAF sections: what a customer can do in each, and what remains the operator's decision. Source: https://www.corepanel.net/docs/client-panel/apps-security/ Last updated: 2026-10-16 Part of the CorePanel documentation — https://www.corepanel.net/docs --- These three sections cover what runs on a customer's sites and what protects them. WordPress is handed over in full, Applications is split between you and the customer, and the WAF is something they can watch but not configure. ## WordPress **What the customer gets.** The whole [WordPress Manager](https://www.corepanel.net/docs/wordpress) for their own sites, with nothing removed: [install](https://www.corepanel.net/docs/wordpress/#installing-wordpress) or [adopt](https://www.corepanel.net/docs/wordpress/#adopting-sites-that-are-already-there) a site, open wp-admin with a [one-time link](https://www.corepanel.net/docs/wordpress/#one-time-login-links), [update](https://www.corepanel.net/docs/wordpress/managing#updates), [harden](https://www.corepanel.net/docs/wordpress/security#the-hardening-switches), [check integrity](https://www.corepanel.net/docs/wordpress/managing#integrity-check), toggle maintenance and debug, and manage [restore points](https://www.corepanel.net/docs/wordpress/managing#restore-points). **The limits** are the same as yours: installs per account and stored restore points per account. Two notes for support: - **Install asks for a domain by name.** Anything that is not theirs is refused, so a typo is an error, not an install in the wrong place. - **Detaching is not deleting.** The site leaves the managed list but its files stay; a rescan adopts it again. ## Applications The one section split between you and the customer. **Yours:** creating, changing and deleting an application — the program it runs, its memory and CPU, where it is published and its CI deploy token. The customer never sees those buttons. **Theirs:** everything afterwards. - **Deploy** a `.tar.gz` (upload or from their home). A release that does not answer is rolled back automatically. - **Roll back** to an earlier release, **start, stop, restart**, and read **the journal**. - **The environment** — add, change, remove and reveal variables. Reveals are audited. > **Caution** > > An environment variable you set for a customer is one they can read and replace. If a > credential must not be theirs, keep it out of their application's environment. ![One application open in the client panel: the header "api", tagged RUNNING and published at corepanel.io/api, with Deploy, Stop and Restart at the right — and no Edit or Delete. Below it the specification read-only (start command ./server --addr unix, limits 512 MB · 100% CPU · 128 tasks, outbound network "Internet and DNS", health path /healthz), a "System status" card giving the unit, active state, main pid and restarts as systemd reports them plus a Health check reading "Answering", and a "Releases" table of three releases, the newest tagged ACTIVE and the two older ones each offering "Roll back".](https://www.corepanel.net/_astro/client-panel-apps-light.DLKXYuVP.png) **Size it with your disk in mind.** Releases unpack under `/opt/userapps/`, outside the account's quota. Each application keeps up to four releases of up to 8 GiB each, so the worst case per account is that times its Applications allowance. An allowance of **0** means none, and the section says so. ## WAF **What the customer sees.** The [WAF](https://www.corepanel.net/docs/security/waf) activity on their own sites: blocked and detected counts, a per-day chart, top attacking addresses and countries, the protections that fired, and the latest events with the full request. In icon view it is under *Security*, and a banner on the home page shows the month's blocked attacks. ![The WAF screen of the client panel, with WAF highlighted in the sidebar: the heading "WAF" over the line "Attacks the firewall stopped before they reached your sites", a site selector reading "All my sites" and a 7D/30D/90D range switch, then three cards — 322 blocked, 43 detected (logged, not blocked) and a last activity of 19 minutes ago over 365 threats seen. Below them the Attack radar, a stacked bar per day of blocked (amber) and detected (grey) threats across a month. At the bottom three cards begin: Top attackers listing client IPs with a country flag and when each was last seen, "Where they came from" ranking countries, and "What they tried" naming the protections that fired — SQL injection attempt in POST, XSS injection attempt in headers, wp-login POST without Referer.](https://www.corepanel.net/_astro/client-panel-security-light.CUILqEAE.png) **Cloudflare is the one setting they control.** At the bottom of the page, a customer whose site is behind Cloudflare sets it to *On*, so the firewall, the logs and PHP see their visitors instead of Cloudflare's addresses. *Hosting default* follows what you set server-wide in [WAF › Proxies](https://www.corepanel.net/docs/security/waf#sites-behind-cloudflare-or-a-proxy), which you can also override per site. ![The bottom of the client panel's WAF screen: the last rows of Recent activity, then a "Cloudflare" card explaining "Turn this on if the site is behind Cloudflare, so the firewall and your logs see your visitors instead of Cloudflare. Leave it off otherwise", a site selector reading corepanel.io, and a three-way switch — Hosting default (off), On, Off — set to On.](https://www.corepanel.net/_astro/client-panel-security-cloudflare-light.CoTIi8w-.png) **What stays with you.** Everything else that configures the WAF: protection packages, rule toggles, exceptions, trusted IPs and proxies. A customer cannot switch a rule off for themselves. **The event reference is how they report a false positive.** Every event carries one, such as `WAF-1284391`, copyable with one click. Paste it into the **Reference** field of your event log to land on that exact request, then write the [exception](https://www.corepanel.net/docs/security/waf-tuning). ![The event detail dialog open over the customer's Recent activity table. Its header reads "Event detail" beside the reference WAF-4205 with a copy icon, and a BLOCKED badge. The body gives the target api.startup.dev with a timestamp, a Network block (remote IP 192.140.58.88, country BR, rule LFI-002 "Local file inclusion"), the request line GET /index.php?page=/etc/shadow, a Query parameters table decoding it to one row (page = /etc/shadow), the four captured headers including a masscan User-Agent, and an empty body. The footer offers only Close — no "Add exception".](https://www.corepanel.net/_astro/client-panel-security-event-light.B1yCSgyL.png)