It is possible to deploy ModSecurity, an open-source web application firewall (WAF) from cPanel, to counter a myriad of online threats. However, you have to activate/enable ModSecurity™ Domain Manager via WHM on the server before users can operate the application on their respective domains.
To Enable ModSecurity™ Domain Manager
1. Log in to the WHM interface with your root account.
2. Go to the navigation menu and select Security Center.
3. Click on ModSecurity™ Vendors.
The Manage Vendors page will appear.
4. First, you will have to install the “OWASP ModSecurity Core Rule Set VX.X” version from the vendor. So, click on +install.
5. Click on the Install and Restart Apache button.
The system will flash a success message saying: You have successfully installed the vendor: OWASP ModSecurity Core Rule Set VX.X.
6. Switch the toggle button in the Enabled column to On.
It will include all sets of the ModSecurity application for the installed vendor.
Apparently, you can determine which sets to include in the ModSecurity application for the vendor.
7. Click on Edit.
8. Toggle the Status of any sets On/Off for the vendor’s ModSecurity as per your requirements.
Now, you will have to enable the ModSecurity feature for your cPanel accounts.
To Enable ModSecurity for cPanel Accounts
1. Go back to the Home of the interface.
2. Select the Packages option on the navigation menu.
3. Click on Feature Manager.
You will have two options here:
- Add a new features list: Build a brand new feature list from scratch and then apply it to a cPanel account.
- Manage feature list: Add the ModSecurity™ Domain Manager feature to the list you are currently using for a cPanel account.
We’ll go with the second option. But, if you wish to know more about creating and managing feature lists, please refer to the article How To Use The Feature Manager In WHM?
4. Click the Edit button under the Manage feature list.
The list of all available features for your server will appear.
5. Tick the box for the ModSecurity™ Domain Manager feature.
6. Scroll down and click the Save button.
With it, you will have enabled ModSecurity for the cPanel accounts. The users can enable/disable the application through their cPanel interface.
