"Security Tab"
The Security tab is the domain's web application firewall cockpit: ModSecurity with the OWASP Core Rule Set, tuned per domain. It is only active while the domain runs in Nginx + Apache mode, because ModSecurity lives on the Apache side; on an Nginx-only domain the tab stays locked (see the editor overview).
Domain Editor → Securityhttps://YOUR-SERVER-IP:8443/domains/edit/DOMAIN-ID#securityMode: Detection Only · Paranoia L1 · Audit log on ON
| Enabled | Rule Set | Rules | Category |
|---|---|---|---|
| ☑ | SQL Injection Protection | 62 | Core |
| ☑ | XSS Protection | 48 | Core |
| ☐ | WordPress Rules | 17 | Application |
203.0.113.66 ×
HSTS: per-domain toggle
ModSecurity: the main switch and its settings
The top card turns ModSecurity on or off for this domain with a single checkbox. While it is on, the settings underneath control how aggressive the WAF is; the selectors and checkboxes save the moment you change them, and the two threshold fields save when you leave the field:
| Setting | Options | Default |
|---|---|---|
| Mode | Detection Only (log threats, do not block) or Active Protection (block immediately) | Detection Only |
| Paranoia Level | 1 Basic (recommended) to 4 Maximum (may cause false positives) | 1 |
| Inbound Anomaly Threshold | 1 to 100; lower is stricter | 5 |
| Outbound Anomaly Threshold | 1 to 100; controls blocking of suspicious responses | 4 |
| Per-domain Audit Log | Logs every ModSecurity event to the domain's logs/modsec_audit.log (can grow the disk) |
On |
Rule sets and exclusions
With ModSecurity on, the Security Rule Sets table lists the OWASP Core Rule Set groups installed on the server: each row shows the set's name and description, how many rules it contains, its category (Core or Application), and a checkbox to enable or disable the whole set for this domain.
For finer surgery, Individual Rule Exclusions disables single rules by their numeric ID: type the ID from an audit-log entry, click Exclude Rule, and it joins the exclusion list as a removable badge. This is the standard cure for a specific rule false-positiving on an otherwise healthy application, without dropping a whole rule set.
Custom ModSecurity rules
Shown while ModSecurity is on: an EXPERT ONLY editor for raw SecRule directives applied to this domain alone. Two warnings frame it: incorrect syntax can break the site, and the editor has its own Save Custom Rules button instead of auto-saving. One nuance to know: saving any other setting on this tab submits the editor's current content along with it, so do not leave half-written rules sitting in the box while flipping switches. Test new rules in Detection Only mode first.
IP Access Control
A dynamic, per-domain blocklist enforced through ModSecurity: type an IP, press Block IP, and it appears as a removable badge; removing a badge lifts the block. Changes save automatically as you add and remove.
HTTP Security Headers
Most security headers are managed server-wide and are shown here read-only for transparency: X-Frame-Options: SAMEORIGIN, X-Content-Type-Options: nosniff and X-XSS-Protection are always applied. The one per-domain choice is HSTS, a toggle that requires the domain to have a valid SSL certificate; it is the same setting exposed on the SSL tab.
Permissions
This tab is the most finely gated in the editor, with seven separate keys: viewing the WAF card, flipping the main switch, editing the settings, managing rule sets and exclusions, writing custom rules, IP blocking and security headers are each their own permission. Cards you lack do not render. IP Access Control and Security Headers are independent of the ModSecurity switch, so they remain visible even while the WAF is off.