Customer Setup Checklist
- Last UpdatedMar 10, 2025
- 10 minute read
This document provides enterprise customers with a complete and easy-to-use checklist for handling Imperva Cloud Application Security configuration and setup.
Overview
It is important that you go through this checklist both before and after your website traffic is routed through the Imperva cloud.
This document is intended to:
- Provide a series of checks to ensure the customer’s environment is properly aligned with Imperva.
- Provide a series of checks that the customer should perform when setting up the Customer account using Imperva’s management portal.
- Provide a series of checks that the customer should perform on each of the domain settings using Imperva services. The domain checklists are divided into two parts:
- Domain settings checks to be performed on the Imperva management portal before activating the service.
- Checks to be performed after activation of the Imperva service.
Terminology
Imperva Account – This is the entity through which a customer enables website traffic to be handled through the Imperva solution. The Imperva account is where the customer can configure settings for the domain, review website performance and monitor traffic statistics.
Domain - A unique name that identifies an internet resource such as a website.
Portal – This refers to the Imperva Cloud Security Console. The customer can log in to the portal, change settings and review statistics and analytics about traffic routed through Imperva.
Quick setup checklist
The following checklist can be used for quick setup purposes. It covers the most important checks from the full setup procedure and in most cases is sufficient to get you started.
However, for best results, we recommend performing the full set of checks as detailed in the subsequent sections of this document.
Full website setup checklist
Customer environment checklist
| Item | What to check | Explanation |
|---|---|---|
| 1. Web Server Firewall | Check that Imperva IPs are whitelisted in your web server firewall. | To ensure that traffic to your website passes through Imperva only, you should block access to it from non Imperva IP addresses  .
A set of rules should be applied to your firewall (or to your .htaccess files) that will block all traffic coming from non-Imperva IP addresses. |
| 2. Hosting Firewall | Make sure that Imperva IPs are whitelisted in the firewall deployed in front of your web server. | To ensure that traffic to your website passes through Imperva only, you should block access to it from non Imperva IP addresses . |
| 3. IP Rate Limiting Block | Make sure that server modules that enforce IP rate limiting are not set to Imperva IPs. | When your traffic is being routed through Imperva, it appears to the hosting infrastructure as if all website traffic is arriving from a limited number of IPs (whereas previously the source IPs were very diverse). If any kind of rate limiting rules are being enforced, for example, to mitigate DDoS attacks, the Imperva Proxy Server IPs might be blacklisted, leading to availability issues for certain locations. |
| 4. Website Caching Consideration | Make sure the website returns the correct caching instructions, when serving content to different clients and or languages. | Imperva will only cache resources and pages if the Vary header is set to "Accept-Encoding." For any other Vary parameters, Imperva will not cache the resource. |
Imperva settings checklist
Site level checklist
The following checklist items should be verified/ performed for each new domain that is added to the account.
| Item | What to check | Explanation |
|---|---|---|
| 1. Does your site support SSL (HTTPS) traffic? | If so, complete the SSL configuration setup, before routing traffic through Imperva. | Imperva has an automated process for generating SSL certificates to support your HTTPS traffic, as well as the ability to use your company’s custom SSL certificate. For further assistance, please contact our Support team. |
| 2. Is HTTPS enabled? | Check if the Certificate status is “Active.” | Portal area: Settings > General > SSL Support section. Check if the certificate status is “Active.” It may take up to 24 hours to create the certificate using Imperva CAs. For further assistance, please contact our Support team. |
| 3. Is HSTS enabled? | Check if the Strict Transport Security (HSTS) is "Enabled." |
Portal area: Application > Website > Site Name > SSL/TLS > Settings section. Enabling HSTS ensures browsers connect to your website only over secure HTTPS connections. For more details on configuring HSTS, visit Customize Website TLS Configuration |
| 4. Origin Server | Make sure that the IPs/CNAME listed in the “origin server” are the addresses to which Imperva should forward the traffic. | Portal area: Settings > Origin Servers. You can change the “Origin Server” configuration to reflect the real customer server topology. To support variant origin server configurations, see Load Balancing Use Cases. |
| 5. Bots/Non Browser Applications | Make sure that you add the non-browser clients (e.g., monitoring service, application API, etc.) to the “bot access control” exception list. | Portal area: Settings > Security > Bot Access Control section.
If your application serves non-browser clients (e.g., monitoring service, application API, etc.), make sure these clients are well defined in your Imperva security policy. It is possible to add exceptions based on: URL, Visitor, IP, Country, User Agent, or a specific parameter. Exception rules will override all other “Bot Access Control” rules. |
| 6. Block Specific Resources | You can edit your security settings to restrict access to your site from specific countries, IPs or certain URLs. | Portal area: Settings > Security > Block Resources. |
| 7. Whitelist Specific Sources | You can edit your security settings to allow access to your site with no inspection from a specific IP, as needed. | Portal area: Settings > Security > Block Resources. Traffic from these IPs will not be filtered by Imperva's security rules and will never be denied access to your site. You can enter single IPs, IP ranges or subnets (e.g. 192.168.1.1, 192.168.1.1-192.168.1.100 or 192.168.1.1/24). |
| 8. Web Application Firewall (WAF) | Make sure that the default action for detecting WAF threats matches your policy. | Portal area: Settings > WAF. By default, the WAF rules are set to the Block Request option. The only exception is the Cross-Site Scripting rule, which is set to Alert Only. You can change the threat default actions to one of the "Block" options or "Ignore." |
| 9. DDOS settings | Make sure to adjust the DDoS policy trigger based on the expected traffic rate and your web server’s capacity.
The default value is 1000 requests per second. |
Portal Area: Settings > WAF > DDOS Click Advanced settings (pop up page will display). If the DDoS mode is set to Automatic, Imperva will enable the DDoS rules only when the traffic to the site exceeds a certain threshold. The threshold should match your web server’s capacity or be above your average daily request rate. |
| 10. Caching settings | To improve your site’s performance, we suggest that you enable caching on Imperva’s CDN. By default, the caching is enabled for “static and dynamic” content. Review the Performance settings and adjust as needed. | Portal area: Settings > Performance.
For more information on each of the options, you can click on the  next to the feature.
|
| 11. Notification | Check which Imperva notifications should be generated on regular basis. | Portal Area: Settings > Notifications. Imperva will notify you by email with respect to WAF events and PCI reports. |
Site checklist after onboarding
Imperva actively protects the site only after the customer switches the site’s DNS settings to Imperva records.
| Item | What to check | Explanation |
|---|---|---|
| 1. DNS Records |
Run a DNS query for the website to check:
|
To check the DNS records, you can use this DNS tool . Imperva only serves HTTP and HTTPS traffic. Any other protocol would be blocked. |
| 2. End-to-End Test | Open the Portal's real-time dashboard. Generate an HTTP/S request to the domain protected by Imperva. Verify that the dashboard displays the request information and that the client receives the content. |
Portal area: Websites > Dashboard > Real-Time. The Real time dashboard should reflect samples of the current session connected to the site through the Imperva PoPs. |
| 3. SSL Test | Make sure the SSL is properly configured. Generate an HTTPS request to your site using a web browser and check that the correct certificate is displayed (either Imperva or your own custom certificate). | If you have uploaded your own certificate to the Portal, your certificate will be used only for SNI supporting web clients (e.g., all modern web browsers). Otherwise, the Imperva generated certificate will be displayed. |
| 4. Non-browser clients test | Generate real traffic from your API clients and other non-browser services to validate that the site’s security policy for non-browser clients is well defined. | It’s important to verify that there are no service interruptions after switching to Imperva DNS for API clients, bots, monitoring services, etc. |
| 5. Security Dashboard | Review your security dashboard and adjust the security policy according to your needs. |
Portal area: Websites > Dashboard > Security. The Dashboard provides information on security events that were detected by Imperva. For some threats, the default action should be changed to “Block” to protect the website. |
| 6. Original Client IP is required | If your application requires a real client IP address, make sure you enable retrieval of this value from either the "X-Forwarded-For" or "Incap-Client-IP" header. | When working with Imperva your server will see Imperva IPs instead of real client IPs. However, by default, Imperva inserts the original client IP address into two HTTP headers: "X-Forwarded-For" and "Incap-Client-IP." |
| 7. System health and maintenance | Visit our status page https://status.imperva.com/ for maintenance information and system status. | We recommend visiting the status page regularly for updates on the service. |
Account level checklist
To open the account settings:
-
On the top menu bar, click Account > Account Management.
-
In the sidebar, click Account Management > Account Settings.
