Harden a Plesk server with Security Advisor and best practices

A fresh Plesk installation is reasonably safe, but a few settings make a big difference once real sites and users are on it. Plesk's free Security Advisor extension checks the most important ones and fixes many in one click. This guide combines it with the other protections every Plesk administrator should enable.

Before you start

• Administrator access to Plesk on a VPS or dedicated server.
• Console access from your provider (for example Virtualizor's VNC) in case a firewall change locks you out.

Run Security Advisor

1. Go to Extensions → Extensions Catalog, search for Security Advisor and install it.
2. Open it from the left menu.
3. Work through the tabs: Domains (sites without HTTPS), WordPress (sites with HTTP admin), and System.
4. Click Secure next to each item. Typical fixes include a Let's Encrypt certificate for the Plesk panel and the mail server, HTTP/2, and enabling the Datagrid scanner.

Secure the Plesk login

• Panel certificate: Tools & Settings → SSL/TLS Certificates – secure Plesk with a certificate for the server hostname.
• Two-factor authentication: install the Google Authenticator (2FA) extension and require it for administrators and resellers.
• Restrict administrative access: Tools & Settings → Restrict Administrative Access lets you allow panel login only from listed IPs.
• Session settings: Tools & Settings → Session Idle Time – shorten it to 30 minutes.

Enable the web application firewall

1. Go to Tools & Settings → Web Application Firewall (ModSecurity).
2. Set the mode to On.
3. Choose a rule set: OWASP ModSecurity Core Rule Set (free) or the Comodo or Atomic sets.
4. Use Detection only for a day first if you host complex applications, then switch to On.

Firewall and Fail2Ban

• Configure the Plesk Firewall to allow only the ports you use; see configure the Plesk Firewall.
• Enable Fail2Ban jails for SSH, mail and the panel; see Fail2Ban in Plesk.
• Disable SSH password login for root and use keys instead.

Keep everything updated

• Tools & Settings → Update Settings: enable automatic installation of Plesk updates and system package updates.
• Remove PHP versions that are end of life once no site uses them.
• In WP Toolkit, enable automatic updates for WordPress core minor versions and trusted plugins.

Protect hosting accounts from each other

• Use PHP-FPM so each subscription's PHP runs as its own user.
• Keep open_basedir enabled in PHP settings.
• Install Imunify360 or another malware scanner for real-time file scanning if your licence allows it.

Troubleshooting

• Locked out after restricting access: use the provider console and run plesk bin admin --enable-access-restriction=false (or remove the rule in Restrict Administrative Access from an allowed IP).
• ModSecurity breaks a site: find the rule ID in the Log Browser and switch it off under Web Application Firewall → Switch off security rules.
• Security Advisor cannot issue panel SSL: the hostname must resolve to the server IP.

Next steps

• Update and upgrade Plesk.
• Schedule backups.
• Common Plesk CLI commands.