Configure ModSecurity (Web Application Firewall) in Plesk

ModSecurity is a web application firewall that inspects HTTP requests and blocks common attacks – SQL injection, cross-site scripting, malicious bots and exploit attempts against popular CMSs. Plesk integrates it with ready-made rule sets and per-domain controls.

Before you start

• Plesk administrator access.
• If missing, install the component under Tools & Settings → Updates → Add/Remove Components → Web hosting → ModSecurity.

Enable ModSecurity

1. Go to Tools & Settings → Web Application Firewall (ModSecurity).
2. Set the Web application firewall mode:
   • Off – disabled.
   • Detection only – logs what would be blocked, blocks nothing.
   • On – blocks matching requests.
3. On the Settings tab choose a rule set: OWASP ModSecurity Core Rule Set (free), Comodo (free) or Atomic (commercial).
4. Choose Update rule set automatically, and a configuration preset (Fast, Tradeoff or Thorough) balancing performance and depth.
5. Click OK.

Start with Detection only for a day or two on servers with complex applications, review the log, then switch to On.

Read the log

On the ModSecurity page, click Log Files to download the audit log, or check a domain's Logs for entries containing ModSecurity: Access denied. Each entry includes the rule ID, the matched part of the request and the client IP.

Fix false positives

• Server-wide: on the Settings tab, add rule IDs to Switch off security rules.
• Per domain: open the domain's Web Application Firewall page and switch off specific rule IDs or change the mode only for that site. This keeps protection on for everyone else.
• Prefer disabling one rule over turning the WAF off for a whole domain.

Typical false positives come from page builders, rich text editors and admin panels that post HTML or code.

Performance

ModSecurity inspects every request, which uses CPU. The Fast preset is lighter; Thorough catches more. Combine with nginx caching so cached pages bypass PHP entirely; see nginx caching.

Defense in depth

A WAF complements but does not replace updates. Keep CMS cores and plugins updated (see WP Toolkit security), use Fail2Ban for login attacks (see Fail2Ban), and run malware scanning where available.

Troubleshooting

• 403 errors after enabling: find the rule ID in the log and switch it off for the affected domain.
• No log entries: mode is Off, or the domain has its own override disabling the WAF.
• High CPU: use the Fast preset or review heavy rule sets.

Next steps

• Security Advisor.
• Log Browser.
• Plesk Firewall.