ModSecurity WAF
ModSecurity is the Web Application Firewall (WAF) that inspects every HTTP request before it reaches a site and blocks attacks: SQL injection, cross-site scripting, remote code execution, file inclusion, scanner probes and more. It runs in Apache using the OWASP Core Rule Set. This page is where you watch what it blocks and tune it when it gets in the way.
Security → ModSecurityhttps://YOUR-SERVER-IP:8443/security/modsecurityHow WAF protection works here
The key thing to understand: the WAF is turned on and off per domain, not globally. Each domain has its own WAF setting in its editor, so you can protect one site and leave another (that a rule keeps tripping) in detection-only mode. This global page does the server-wide parts: it shows the blocked-request log across all domains, manages a global whitelist and custom rules, and sets rate limiting. The OWASP CRS itself is always active; there is no server-wide off switch, because turning protection off is a per-domain decision.
The security log
The Security Logs tab is the heart of the page: every request the WAF blocked or flagged, with the source IP (and its country), method, URL, the action taken (blocked or logged), the rule that fired, its severity, and an anomaly score. Search and filter by IP, URL, attack type, rule or severity, and expand any row for the full detail including the raw event. This is where you diagnose both real attacks and false positives.
Fixing false positives
Sometimes a legitimate request looks like an attack (a page editor posting HTML, an API sending SQL-like text). Panelica gives you two ways to make an exception, both server-wide:
- Whitelist: exempt a trusted IP or range, URL, User-Agent, or parameter from the WAF. This is the blunt, safe tool: whitelist your office IP or a specific admin URL and the WAF stops inspecting it.
- Custom Rules: for surgical control, write your own ModSecurity rule (for example, disable one specific rule ID on one path) rather than exempting an entire request.
apachectl -t syntax test. If your rule is malformed, the change is rolled back to the previous config and rejected with an error, so a bad rule can never take Apache down. Whitelist and custom rules live in dedicated ID ranges so they never collide with the CRS.Rate limiting
The Configuration tab sets a request rate limit (requests per IP within a time window) enforced by the WAF, which throttles a single IP hammering your sites. A "clear all counters" action resets the tracked counts (releasing currently-throttled IPs) when you need a clean slate.
Access
Behind the modsecurity license feature and, at the backend, ROOT and ADMIN (see roles and permissions). Per-domain WAF enablement lives in each domain's Security tab; this page is the server-wide cockpit.