KoaPanel
IT Try it free
All manual sections

DocumentationApplication firewall

Application firewall

The application firewall (WAF) checks every request to the sites with ModSecurity and the OWASP Core Rule Set, the rules cPanel uses too, and stops the most common attacks before they reach PHP: SQL injection, cross-site scripting (XSS), file inclusion, command execution, vulnerability scanners. It adds to the network firewall, which blocks ports and addresses instead.

Turning it on for the server

An administrator turns it on from the Firewall tab of a site, Application firewall of the server card. The first time the panel installs the ModSecurity module of nginx and the rules (about a minute). You choose:

  • the default mode of the sites: detection only (logs the attacks without blocking) or blocking (suspicious requests get a 403 error);
  • the protection level (OWASP CRS paranoia): 1 is fine for almost every site; higher levels find more attacks but also give many more false alarms.

The rules are loaded only once for the whole server, and every change is checked (nginx -t) before it's applied.

Tip: start with detection only, look at the events of the sites for a few days, exclude the rules that give false alarms and only then switch to blocking.

The firewall of a site

In the Firewall tab of the site choose the mode: like the server, off, detection only or blocking. A site that is off has no rule active.

False alarms and exclusions

Sometimes a rule blocks a legitimate request: a page editor that sends HTML code, a plugin that uses unusual parameters. In Recent events you see for every suspicious request the address, the page, the result (blocked or only detected) and the rules that matched, with their number. Press Exclude this rule (or write the number in Excluded rules): the rule no longer checks the requests of that site, while it stays active for the others.

Events are kept for 7 days. Requests that don't match any rule aren't logged.

Good to know

  • The check covers the requests (addresses, parameters, forms, headers), not the pages sent to the visitors: the impact on speed is small.
  • WordPress, PrestaShop and the other applications work with level 1; if something in the site's admin area stops working in blocking mode, look at the events and exclude the rule shown.
  • Behind a CDN the firewall sees the address of the CDN, not the visitor's.
  • It works on Ubuntu 24.04 and 26.04, AlmaLinux 9 and Rocky Linux 9. On AlmaLinux and Rocky the nginx module comes from EPEL and the OWASP CRS rules (3.3.10) from their official release, verified before they are installed; SELinux stays on.