How do I disable particular ModSecurity rule in Plesk?
Let’s known about ModSecurity rules first:
ModSecurity is also termed as Modsec. It is created as module for the use of Apache HTTP Server. It has few features such as:
ModSecurity platform itself gives a configuration in rules known as SecRules. The rules are mainly designed to filter out, creating login and monitoring real time features in HTTP. You might hear about OWASP ModSecurity core rule set. Yes, ModSecurity rules are maintained as the protection guard to eradicate vulnerabilities.
For this reason, ModSecurity rules are used with proper setup in Plesk and other usage.
Applications have both positive and negative. In that case, for any risk over we might cross out the situation to disable ModSecurity rules in Plesk.
Method 1: ModSecurity Disable for single domain:
Step 1: Go to Plesk and then click on domains. Tap on the domain name and then choose Web Application Firewall (ModSecurity).
Step 2: After clicking on ModSecurity (WAF), choose the section “switch off security rules”. Enter few details such as tag and Rule ID.
Step 3: You can also check logs and disable particular ModSecurity rule with "Security rule IDs" option.
Step 4: Finally, click OK.
Method 2: Server-wide disable:
Step 1: Open your Plesk account, choose Tools & Settings and then click on WAF ModSecurity. Again, choose the section “Switch off security rules”’.
Step 2: Here, you can use two options such as disabling through tags and rule ID.
Using Tags: There is a option to make one rule tag as enable to disable. Choose the rule tag and disable it. Tap on OK button.
Using RuleID: Open up the error message there you can see few ruleID. Add it to the field of Security rule ID. Finally, tap on apply changes.
Method 3: Apache directives Disable:
Step 1: From you domain, choose Apache & nginx settings. Now, you need to create an Apache directive only so, you can redirect it into HTTPA Apache directive.
Step 2: If you want to remove specific rule ID then use below statement:
That’s it! It will automatically get disabled.
Let’s known about ModSecurity rules first:
ModSecurity is also termed as Modsec. It is created as module for the use of Apache HTTP Server. It has few features such as:
- It is an open-source application used widely in WAF (Wireless application firewall).
- Built to give an array feature to Hypertext transfer protocol.
- Gathers the capability to filter as well as gives security for few platforms such as Nginx, Microsoft IIS and Apache HTTP Server.
ModSecurity platform itself gives a configuration in rules known as SecRules. The rules are mainly designed to filter out, creating login and monitoring real time features in HTTP. You might hear about OWASP ModSecurity core rule set. Yes, ModSecurity rules are maintained as the protection guard to eradicate vulnerabilities.
For this reason, ModSecurity rules are used with proper setup in Plesk and other usage.
Applications have both positive and negative. In that case, for any risk over we might cross out the situation to disable ModSecurity rules in Plesk.
Method 1: ModSecurity Disable for single domain:
Step 1: Go to Plesk and then click on domains. Tap on the domain name and then choose Web Application Firewall (ModSecurity).
Step 2: After clicking on ModSecurity (WAF), choose the section “switch off security rules”. Enter few details such as tag and Rule ID.
Step 3: You can also check logs and disable particular ModSecurity rule with "Security rule IDs" option.
Step 4: Finally, click OK.
Method 2: Server-wide disable:
Step 1: Open your Plesk account, choose Tools & Settings and then click on WAF ModSecurity. Again, choose the section “Switch off security rules”’.
Step 2: Here, you can use two options such as disabling through tags and rule ID.
Using Tags: There is a option to make one rule tag as enable to disable. Choose the rule tag and disable it. Tap on OK button.
Using RuleID: Open up the error message there you can see few ruleID. Add it to the field of Security rule ID. Finally, tap on apply changes.
Method 3: Apache directives Disable:
Step 1: From you domain, choose Apache & nginx settings. Now, you need to create an Apache directive only so, you can redirect it into HTTPA Apache directive.
Step 2: If you want to remove specific rule ID then use below statement:
Code:
<IfModule mod_security2.c>
SecRuleRemoveById 362902 386402
</IfModule>
