On October 19, 2021, we have enabled single-sign-on for our Plesk Support Center to provide a seamless login/account experience. This implies that you’ll be able to use a single account across any of our web-facing properties.
If you had already registered your account at Plesk 360 (formerly known as My Plesk) please use one for login. Otherwise please re-register it using the same email address as your existing Zendesk login (support account). It’s essential that you use the same email address on our support center to ensure that your tickets stay attached to the same account.

Articles in this section

See more

How to disable specific ModSecurity rules in Plesk

Avatar
Kuzma Ivanov
Updated
Follow
Plesk for Linux kb: how-to ABT: Group A

Applicable to:

  • Plesk for Linux

Question

How to disable specific ModSecurity rules in Plesk per domain or server-wide?

Answer

Note: Not all rules can be disabled due to the MODSEC-274 bug in ModSecurity.

 

Disabling rules for a domain

 

  • Via ModSecurity settings

    1. Log in to Plesk.

    2. Go to Domains > example.com > Web Application Firewall (ModSecurity).

    3. In the Switch off security rules section, specify rule IDs (for example, 340003), tags (for example, CVE-2011-4898), or a regular expression (for example, XSS) used in the rules that need to be switched off, and click OK.

      Note: The the Switch off security rules section is available only when the web application firewall mode is set to On or Detection only.

      • By rule IDs


        Web Application Firewall Settings

      • By rule tags


        Web Application Firewall Settings

       

     

  • Via additional Apache directives

    Note: This solution is intended for Plesk administrators only.

    1. Log in to Plesk.

    2. Go to Domains > example.com > Apache & nginx Settings.

    3. Create a custom Apache directive and put it into the Additional directives for HTTP/HTTPS fields. In the following example, rules with IDs 340162 and 340163 will be disabled:

      Note: It is possible to specify more than one RuleID. Add another line with RuleID on a new line.

      CONFIG_TEXT: <IfModule mod_security2.c>
      SecRuleRemoveById 340162
      SecRuleRemoveById 340163
      </IfModule>

      OR

      CONFIG_TEXT: <IfModule mod_security2.c>
      SecRuleRemoveById 340162 340163
      </IfModule>

 

Disabling rules server-wide 

 

  1. Log in to Plesk.

  2. Go to Tools & Settings > Web Application Firewall (ModSecurity) > Switch off security rules.

  3. Switch off rules using one of the following ways:

    • By rule IDs. Add IDs from the error message to the Security rule IDs field as shown on the following picture (Click to enlarge) and apply the changes.

      Note: If there are several rule IDs, put each on a new line.


      Web Application Firewall Settings

    • By rule tags. Add rule tags from the error message from Active to Deactivated as shown on the following picture (Click to enlarge) and apply the changes.


      Web Application Firewall Settings

 

Comments

3 comments

Sort by Date Votes
  • Avatar
    Fouad Ahmed Fouad

    Can we disable or skip mod_security for only one directory with Plesk?

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    Hello Fouad Ahmed Fouad

    This may be done only by the manual configuration change. Use this link for the reference.

    1
    Comment actions Permalink
  • Avatar
    Abdul Haseeb Kamal

    I used .htaccess file with following content in it:
    SecFilterEngine Off
    SecFilterScanPOST Off

    but got an error
    Internal server error

    How do I know that mod_security is disabled?

     

    -----------------------------------------------------------------------------------

    Edit: Free Samples in Nigeria

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles