Turn on ModSecurity rules that block SQL injection, cross-site scripting and other common attacks.
Your account is already protected by our network firewall and DDoS protection. The web application firewall (ModSecurity) adds another layer: it inspects every request to your website and blocks the ones that look like attacks, such as SQL injection and cross-site scripting.
Turning it on
- Sign in to HostPanel and go to Domains → Domain List.
- Click your domain to open its settings, then open the Security tab.
- Switch on ModSecurity WAF.
- Leave Mode on Detection Only for a few days. In this mode, attacks are logged but nothing is blocked, so you can check that normal visitors are not affected.
- When you are happy, change Mode to Active Protection. Blocking starts immediately.
The Security tab only works when the domain's web server is Nginx & Apache. See Nginx only or Nginx and Apache?
Choosing rule sets
Under Security Rule Sets, tick the protections you want, for example SQL Injection Protection, XSS Protection and, for WordPress sites, WordPress Rules.
A genuine visitor is being blocked
Occasionally a rule blocks something legitimate, such as saving a page in your website's editor. Note the rule number from the error or the audit log and add it under Individual Rule Exclusions with Exclude Rule. If you are not sure which rule it is, open a support ticket with the time and the address of the page, and we will find it for you.
Leave the Paranoia Level at 1. Higher levels catch more attacks but block far more genuine visitors.