{"id":20724,"date":"2026-08-04T18:37:25","date_gmt":"2026-08-04T13:07:25","guid":{"rendered":"https:\/\/www.milesweb.in\/hosting-faqs\/?p=20724"},"modified":"2026-08-04T18:37:26","modified_gmt":"2026-08-04T13:07:26","slug":"how-to-enable-waf-in-plesk","status":"publish","type":"post","link":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/","title":{"rendered":"How to Enable WAF in Plesk?"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Plesk includes ModSecurity as its native web application firewall. The extension checks each incoming request against a signature database. It blocks anything matching a known attack before your website ever sees it. Most admins turn the feature on right after a fresh Plesk install. Some administrators enable it only after a security review identifies the vulnerability. This walkthrough covers the full setup, from installation to a working test.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Do You Turn On WAF in Plesk?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Locate the Extensions Menu<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Log into your Plesk panel. Click Extensions in the left sidebar. The catalog loads within seconds. Please ensure your account has admin rights, since extension installs need that level of access.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Install the ModSecurity Extension<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Locate ModSecurity in the list. Click Install. Plesk pulls the module and configures it for you. No terminal work needed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Access WAF Settings<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Open Tools &amp; Settings. Look for the <a href=\"https:\/\/www.milesweb.in\/blog\/website-security\/what-is-a-web-application-firewall\/\">Web Application Firewall<\/a> (ModSecurity) under Security. Some license tiers place it elsewhere, so check Extensions too if it&#8217;s missing. This panel holds every WAF setting, so bookmark it if you manage more than one server.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Choose a Rule Set<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pick between Atomic Basic and Comodo. Comodo covers more attack types. Sites running several plugins or applications benefit most from that wider coverage. Atomic Basic fits smaller, simpler setups. You can switch between the two later without any downtime.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: Pick an Operation Mode<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Set the mode to On for immediate blocking. Set it to detect your traffic, such as a contact form being incorrect. New websites benefit from a few days of detection only at first. This process reveals which rules are ineffective on your traffic, such as a contact form being incorrect, before you switch to full enforcement.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Related Read: <a href=\"https:\/\/www.milesweb.in\/hosting-faqs\/enable-disable-modsecurity-rules-directadmin\/\">How to Enable and Disable ModSecurity Rules with DirectAdmin?<\/a><br><\/strong><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: Apply Settings Server-Wide or Per Domain<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Decide the reach. A server-wide rule hits every domain you host. A per-domain rule overrides the server-wide rule for a specific website. Use per-domain rules when one client runs a CMS that trips the default ruleset or a payment app that needs stricter checks than the rest of your domains.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Save and Confirm Activation<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Click Apply. Reload the settings page manually. A successful save turns the status field to On. A field still showing Off means the rule set or mode didn&#8217;t register. Reselect both, then click Apply again.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Test the Firewall<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Send a mock attack request. A standard SQL injection string appended to a URL works well for this test. Watch for the block. Then check the ModSecurity logs to confirm the entry matches what you just triggered.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Related Read: <a href=\"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-monitor-waf-logs\/\">How to Monitor WAF Logs?<\/a><\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Concluding Note<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A WAF only works while you maintain it. Please review the logs on a regular schedule. If a rule mistakenly blocks a real visitor, whitelist that specific rule. Update the rule set as new threats appear. Skip this upkeep, and protection quietly fades into a checkbox nobody revisits.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Plesk includes ModSecurity as its native web application firewall. The extension checks each incoming request against a signature database. It blocks anything matching a known attack before your website ever sees it. Most admins turn the feature on right after a fresh Plesk install. Some administrators enable it only after a security review identifies the [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[891],"tags":[],"class_list":["post-20724","post","type-post","status-publish","format-standard","placeholder-for-hentry","category-firewall"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>How to Enable WAF in Plesk?<\/title>\n<meta name=\"description\" content=\"Learn how to enable WAF in Plesk to protect your website from common web threats and strengthen security with simple configuration steps.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Enable WAF in Plesk?\" \/>\n<meta property=\"og:description\" content=\"Learn how to enable WAF in Plesk to protect your website from common web threats and strengthen security with simple configuration steps.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting FAQs by MilesWeb\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-04T13:07:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-08-04T13:07:26+00:00\" \/>\n<meta name=\"author\" content=\"Pravin Dahadade\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pravin Dahadade\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/\"},\"author\":{\"name\":\"Pravin Dahadade\",\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/#\\\/schema\\\/person\\\/8ec3f61c42d57dcdfe230b85246842ad\"},\"headline\":\"How to Enable WAF in Plesk?\",\"datePublished\":\"2026-08-04T13:07:25+00:00\",\"dateModified\":\"2026-08-04T13:07:26+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/\"},\"wordCount\":503,\"commentCount\":0,\"articleSection\":[\"Firewall\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/\",\"url\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/\",\"name\":\"How to Enable WAF in Plesk?\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/#website\"},\"datePublished\":\"2026-08-04T13:07:25+00:00\",\"dateModified\":\"2026-08-04T13:07:26+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/#\\\/schema\\\/person\\\/8ec3f61c42d57dcdfe230b85246842ad\"},\"description\":\"Learn how to enable WAF in Plesk to protect your website from common web threats and strengthen security with simple configuration steps.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/how-to-enable-waf-in-plesk\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Enable WAF in Plesk?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/#website\",\"url\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/\",\"name\":\"Web Hosting FAQs by MilesWeb\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/#\\\/schema\\\/person\\\/8ec3f61c42d57dcdfe230b85246842ad\",\"name\":\"Pravin Dahadade\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b33e81528d0c0c8b54709667a8e24811e5beceedd59a44524cc9eccbffab70e4?s=96&d=blank&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b33e81528d0c0c8b54709667a8e24811e5beceedd59a44524cc9eccbffab70e4?s=96&d=blank&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/b33e81528d0c0c8b54709667a8e24811e5beceedd59a44524cc9eccbffab70e4?s=96&d=blank&r=g\",\"caption\":\"Pravin Dahadade\"},\"description\":\"With an interest in doing something creative daily. I like to write technical blogs related to web hosting, digital marketing, and other IT topics. Also like to spend leisure time on social media to find different strategies for client engagement.\",\"sameAs\":[\"https:\\\/\\\/www.milesweb.com\\\/\"],\"url\":\"https:\\\/\\\/www.milesweb.in\\\/hosting-faqs\\\/author\\\/pravin-d\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Enable WAF in Plesk?","description":"Learn how to enable WAF in Plesk to protect your website from common web threats and strengthen security with simple configuration steps.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/","og_locale":"en_US","og_type":"article","og_title":"How to Enable WAF in Plesk?","og_description":"Learn how to enable WAF in Plesk to protect your website from common web threats and strengthen security with simple configuration steps.","og_url":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/","og_site_name":"Web Hosting FAQs by MilesWeb","article_published_time":"2026-08-04T13:07:25+00:00","article_modified_time":"2026-08-04T13:07:26+00:00","author":"Pravin Dahadade","twitter_misc":{"Written by":"Pravin Dahadade","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/#article","isPartOf":{"@id":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/"},"author":{"name":"Pravin Dahadade","@id":"https:\/\/www.milesweb.in\/hosting-faqs\/#\/schema\/person\/8ec3f61c42d57dcdfe230b85246842ad"},"headline":"How to Enable WAF in Plesk?","datePublished":"2026-08-04T13:07:25+00:00","dateModified":"2026-08-04T13:07:26+00:00","mainEntityOfPage":{"@id":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/"},"wordCount":503,"commentCount":0,"articleSection":["Firewall"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/","url":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/","name":"How to Enable WAF in Plesk?","isPartOf":{"@id":"https:\/\/www.milesweb.in\/hosting-faqs\/#website"},"datePublished":"2026-08-04T13:07:25+00:00","dateModified":"2026-08-04T13:07:26+00:00","author":{"@id":"https:\/\/www.milesweb.in\/hosting-faqs\/#\/schema\/person\/8ec3f61c42d57dcdfe230b85246842ad"},"description":"Learn how to enable WAF in Plesk to protect your website from common web threats and strengthen security with simple configuration steps.","breadcrumb":{"@id":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.milesweb.in\/hosting-faqs\/how-to-enable-waf-in-plesk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.milesweb.in\/hosting-faqs\/"},{"@type":"ListItem","position":2,"name":"How to Enable WAF in Plesk?"}]},{"@type":"WebSite","@id":"https:\/\/www.milesweb.in\/hosting-faqs\/#website","url":"https:\/\/www.milesweb.in\/hosting-faqs\/","name":"Web Hosting FAQs by MilesWeb","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.milesweb.in\/hosting-faqs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.milesweb.in\/hosting-faqs\/#\/schema\/person\/8ec3f61c42d57dcdfe230b85246842ad","name":"Pravin Dahadade","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/b33e81528d0c0c8b54709667a8e24811e5beceedd59a44524cc9eccbffab70e4?s=96&d=blank&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/b33e81528d0c0c8b54709667a8e24811e5beceedd59a44524cc9eccbffab70e4?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b33e81528d0c0c8b54709667a8e24811e5beceedd59a44524cc9eccbffab70e4?s=96&d=blank&r=g","caption":"Pravin Dahadade"},"description":"With an interest in doing something creative daily. I like to write technical blogs related to web hosting, digital marketing, and other IT topics. Also like to spend leisure time on social media to find different strategies for client engagement.","sameAs":["https:\/\/www.milesweb.com\/"],"url":"https:\/\/www.milesweb.in\/hosting-faqs\/author\/pravin-d\/"}]}},"_links":{"self":[{"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/posts\/20724","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/comments?post=20724"}],"version-history":[{"count":2,"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/posts\/20724\/revisions"}],"predecessor-version":[{"id":20727,"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/posts\/20724\/revisions\/20727"}],"wp:attachment":[{"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/media?parent=20724"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/categories?post=20724"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.milesweb.in\/hosting-faqs\/wp-json\/wp\/v2\/tags?post=20724"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}