Does the Patchstack plugin work on the server level or on an application level?

The Patchstack firewall runs on the application layer, the same layer where your website is running. This means you do not need SSH access or root access to install a custom package onto your server.

In the case of the WordPress plugin you install it like any other plugin. In the case of general PHP applications you upload the files and then inject the firewall into your website. This varies depending on what PHP website software you are using.