Managing the Web App Firewall in DirectAdmin
Summary
This guide explains how to enable, configure, and manage the Web App Firewall (WAF) in DirectAdmin. The WAF protects your website from common attacks such as SQL injection, cross‑site scripting (XSS), brute‑force attempts, and malicious bots.
Overview
DirectAdmin’s Web App Firewall is typically powered by:
- ModSecurity (Apache/Nginx)
- OWASP Core Rule Set (CRS)
The firewall analyzes incoming requests and blocks suspicious or harmful traffic before it reaches your website.
Requirements
- DirectAdmin user-level access
- ModSecurity installed and enabled by the hosting provider
- A domain hosted on the server
Step-by-Step Instructions
1. Access the Web App Firewall
- Log in to DirectAdmin
- Go to Advanced Features → Web App Firewall
- Select the domain you want to manage
2. Enable or Disable the Firewall
You will see a toggle or dropdown:
- Enable WAF (recommended)
- Disable WAF (not recommended unless troubleshooting)
When enabled, ModSecurity rules immediately begin filtering traffic.
3. Choose a Rule Set (If Available)
Some servers allow selecting:
- OWASP CRS (default, recommended)
- Comodo WAF rules
- Custom rule sets
Choose the rule set that best fits your application.
4. View Firewall Logs
- Go to the Logs section inside the WAF page
- Review blocked requests
- Look for:
• False positives
• Repeated attack attempts
• IPs triggering multiple rules
5. Whitelist an IP or Rule (If Needed)
If a legitimate request is being blocked:
- Find the rule ID in the log
- Add it to the “Whitelist” or “Ignore Rule” section
- Or whitelist a specific IP address
Use whitelisting sparingly to avoid reducing security.
6. Disable Specific Rules (Advanced)
If a rule causes issues with your CMS or application:
- Locate the rule ID
- Add it to the “Disabled Rules” section
- Save changes
Common Use Cases
Protect WordPress Sites
Blocks brute‑force login attempts, XML‑RPC abuse, and malicious bots.
Protect E‑commerce Sites
Prevents SQL injection and checkout‑related attacks.
Protect Custom Applications
Stops malformed requests and code‑injection attempts.
Troubleshooting
Website Features Not Working
- A WAF rule may be blocking legitimate requests
- Check logs for rule IDs
- Whitelist or disable the specific rule
403 Forbidden Errors
- ModSecurity may be blocking form submissions
- Identify the rule in the logs
- Whitelist the rule or adjust the form
False Positives on APIs
- APIs often trigger strict rules
- Whitelist the API endpoint or IP
High Number of Blocks
- Could indicate an active attack
- Consider enabling rate limiting (if available)
- Review server logs for patterns
Security Notes
- Always keep the WAF enabled unless diagnosing an issue
- Avoid disabling the entire firewall — disable only specific rules
- Review logs regularly for suspicious activity
- Combine WAF with strong passwords and 2FA for maximum protection
Related Articles
- [Password Protected Directories](ca://s?q=Password_Protected_Directories)
- [Two‑Step Authentication](ca://s?q=Two_Step_Authentication)
- [SSH Keys](ca://s?q=SSH_Keys)
- [Backup & Restore](ca://s?q=Backup_and_Restore)
- [Catch‑All E‑mails](ca://s?q=Catch_All_Emails)