How to Deploy the Noiz ModSecurity Rules on ISPConfig

This guide shows you how to deploy the Noiz custom ModSecurity rule set to a website on an ISPConfig server and how to verify the rules are live. The rules themselves, what each one does and the policy behind it, are in The Noiz ModSecurity Rule Set.

Last reviewed: 1 August 2026, against ISPConfig 3.3.1p1 with Apache + ModSecurity 2. It complements the official ISPConfig documentation; the Apache directives field is the ISPConfig mechanism for per-site custom configuration.

Prerequisites

• Administrator access to the ISPConfig panel, or a client login whose site you are configuring.
• The Noiz custom rule block, from Security/modsec-custom-rules-2026-08-01-v8-annotated.txt in the knowledgebase repository. Paste the whole block, comments included; the parser ignores # lines.
• ModSecurity enabled for Apache on the server (the modsecurity2 Apache module). If it is not loaded, the directives have no effect; see your server administrator.

Deploy through the website’s Apache directives

ISPConfig does not have a dedicated firewall page. Per-site Apache configuration, which includes ModSecurity directives, goes in the website’s Apache directives field. This is the authoritative channel: ISPConfig regenerates the site’s Apache vhost from it on every save, so a manual edit to the vhost file is overwritten.

1. Log in to ISPConfig.
2. Go to Sites → Websites → Website, and open the website you are protecting.
3. Open the Options tab.
4. Find the Apache directives textarea.
5. Paste the whole rule block into the textarea and save.

The directives are written into that site’s vhost. Because they apply per website, repeat for each site you want to protect, or apply the rules server-wide instead (below).

Applying the rules to every site on the server

To protect all sites at once rather than one vhost at a time, an administrator can load the rule block at the server level instead of per site, in the Apache or ModSecurity configuration include directory (for example a file under /etc/apache2/mods-enabled/ or /etc/apache2/conf-enabled/). A server-level file is not regenerated by ISPConfig, so it survives panel saves. Per-site and server-level deployment are alternatives; do not do both, or the rules load twice and Apache reports duplicate rule-id errors.

Verify the rules are live

After a change, run from a root shell:

apachectl configtest && systemctl reload apache2
grep -rc "id:1000210" /etc/apache2/sites-enabled/   # one match in the site's vhost

For a server-level deployment, grep the include file you wrote instead. Then confirm the rate-limit counters are collecting:

ls /var/cache/modsecurity/          # www-data-ip.dir collections appear with traffic

The per-IP counters are stored on disk and are box-global, so the rate limit is real per-IP enforcement.

If something is wrong

If a legitimate visitor is being blocked, or a rule is not firing, see Troubleshooting the Noiz ModSecurity Custom Rules. If you cannot resolve it, contact Noiz support.