This plugin is the panel front end for ModSecurity v3 with the OWASP Core Rule Set. It does not install anything itself: the bundled install.sh detects the running web server — Apache2, nginx, or OpenLiteSpeed — installs the appropriate ModSecurity connector and CRS, and wires them in. Apache is preferred when present, because mod_security2 from the distribution is more dependable than the nginx connector.

From the page an admin sets the global engine mode (blocking, log-only, or off), adjusts the CRS paranoia level and the anomaly-scoring threshold, and can drop into a raw configuration editor when the guided controls are not enough. When a legitimate request keeps tripping a rule you can disable that rule by id with a note explaining why, re-enable it later, or whitelist a source IP. Individual domains can be given their own engine mode, overriding the global setting — useful for a single site that cannot tolerate blocking yet — and their own rule exclusions, limited to a path if needed. Countries can be blocked (or only some allowed) for the whole server or one site, using a local GeoIP country database; login pages get a per-IP brute-force limit; and the OWASP CRS can be updated to the latest release in one click, verified by SHA-256 and rolled back if the web server rejects it. When the web server is switched, the WAF reinstalls ModSecurity for the new one.

Recent blocks are read back from the audit log; log parsing is delegated to a compiled Go helper when the binary is present. Website owners who are not admins get a read-only view: the effective mode for each domain they own, whether it is overridden, and the recent attacks aimed at those domains. All actual WAF control stays with admins. Uninstalling the plugin sets the engine to off rather than leaving a half-configured firewall behind.

Min Panel Version

1.0.0

Platform

Ubuntu 20.04+ / 22.04+ / 24.04+

License

Paid license required

Dependencies

apache2

Hooks

web_server_changed

Permissions

firewall.manage

VinzaPanel handles installation automatically via the Vinza Store. Make sure the panel agent has internet access to download dependencies.

1.0.7 — New icon in the shared flat style. 1.0.6 — Rule exclusions per site and path (rule ids, ranges or tags, e.g. 942100 under /wp-admin/ on one domain). Country blocking for the whole server or per site, deny-list or allow-list, using the DB-IP Country Lite database the Statistics app reads (downloadable from the page, CC BY 4.0). Login brute-force limit: POSTs to wp-login.php, xmlrpc.php, /administrator/, /user/login or your own paths are counted per IP and the address is blocked for a set time. One-click OWASP CRS update from the GitHub release, verified against its published SHA-256, with config test and automatic rollback. After switching the web server (nginx ⇄ Apache) the WAF reinstalls ModSecurity for the new one; until then the page says the WAF is inactive and offers a Re-enable button. A leftover nginx ModSecurity include whose module was removed no longer stops nginx from starting. 1.0.5 — Paranoia level and anomaly threshold now take effect: they were written into commented-out lines. Re-enabling a rule re-enables only that rule (9201 also re-enabled 920100). Security: names shown in the page (from the server, its sites or its users) are passed to buttons safely; a quote in one could run script in the admin's browser. 1.0.4 — On nginx the WAF is really wired now: the generated modsecurity.conf repeated the CRS's SecDefaultAction lines, which libmodsecurity v3 refuses, so the conf.d drop-in failed nginx -t, was rolled back silently and the page showed "not wired". Existing servers are repaired on update. 1.0.3 — On nginx the WAF now actually inspects requests: ModSecurity is enabled for every site through /etc/nginx/conf.d/vinza-modsecurity.conf (rolled back if nginx rejects it). Before, the page said "On" while nginx never loaded the rules. The status shows when the web server does not load ModSecurity. Whitelist entries must be a valid IP address or network ("not-ip" was accepted), and adding/removing matches the exact address (10.0.0.1 was treated as already whitelisted when 110.0.0.15 was). Uninstall removes the nginx include before the rules it points to. 1.0.2 — The log-only exception for webmail follows the webmail address chosen in Mail Server 1.2.0 (default /vinzamail/) instead of a fixed /webmail/. Initial release — ModSecurity v3 integration, OWASP CRS, anomaly scoring, per-website rule exclusion.

Use VinzaPanel's REST API to download and install this app programmatically.

Download app files

HTTP

POST /plugins/api/download/waf/
Content-Type: application/json

{
  "panel_version": "1.0.0"
}

Example response

JSON

{
  "success": true,
  "plugin_id": "waf",
  "version": "1.0.7",
  "download_url": "..."
}