Plesk includes ModSecurity as its native web application firewall. The extension checks each incoming request against a signature database. It blocks anything matching a known attack before your website ever sees it. Most admins turn the feature on right after a fresh Plesk install. Some administrators enable it only after a security review identifies the vulnerability. This walkthrough covers the full setup, from installation to a working test.
How Do You Turn On WAF in Plesk?
Step 1: Locate the Extensions Menu
Log into your Plesk panel. Click Extensions in the left sidebar. The catalog loads within seconds. Please ensure your account has admin rights, since extension installs need that level of access.
Step 2: Install the ModSecurity Extension
Locate ModSecurity in the list. Click Install. Plesk pulls the module and configures it for you. No terminal work needed.
Step 3: Access WAF Settings
Open Tools & Settings. Look for the Web Application Firewall (ModSecurity) under Security. Some license tiers place it elsewhere, so check Extensions too if it’s missing. This panel holds every WAF setting, so bookmark it if you manage more than one server.
Step 4: Choose a Rule Set
Pick between Atomic Basic and Comodo. Comodo covers more attack types. Sites running several plugins or applications benefit most from that wider coverage. Atomic Basic fits smaller, simpler setups. You can switch between the two later without any downtime.
Step 5: Pick an Operation Mode
Set the mode to On for immediate blocking. Set it to detect your traffic, such as a contact form being incorrect. New websites benefit from a few days of detection only at first. This process reveals which rules are ineffective on your traffic, such as a contact form being incorrect, before you switch to full enforcement.
Related Read: How to Enable and Disable ModSecurity Rules with DirectAdmin?
Step 6: Apply Settings Server-Wide or Per Domain
Decide the reach. A server-wide rule hits every domain you host. A per-domain rule overrides the server-wide rule for a specific website. Use per-domain rules when one client runs a CMS that trips the default ruleset or a payment app that needs stricter checks than the rest of your domains.
Step 7: Save and Confirm Activation
Click Apply. Reload the settings page manually. A successful save turns the status field to On. A field still showing Off means the rule set or mode didn’t register. Reselect both, then click Apply again.
Step 8: Test the Firewall
Send a mock attack request. A standard SQL injection string appended to a URL works well for this test. Watch for the block. Then check the ModSecurity logs to confirm the entry matches what you just triggered.
Related Read: How to Monitor WAF Logs?
Concluding Note
A WAF only works while you maintain it. Please review the logs on a regular schedule. If a rule mistakenly blocks a real visitor, whitelist that specific rule. Update the rule set as new threats appear. Skip this upkeep, and protection quietly fades into a checkbox nobody revisits.
