Does the Patchstack plugin work on the server level or on an application level?

The Patchstack firewall runs on the application layer, the same layer where your website is running. This means you do not need SSH access or root access to install a custom package onto your server.

You install it like any other plugin on WordPress.