Skip to content
Noiz Knowledgebase

How to Deploy the Noiz ModSecurity Rules on Plesk

This guide shows you how to deploy the Noiz custom ModSecurity rule set to a Plesk server and how to verify the rules are live. The rules themselves, what each one does and the policy behind it, are in The Noiz ModSecurity Rule Set.

Last reviewed: 1 August 2026, against Plesk on Ubuntu with Apache + ModSecurity 2 and Imunify360. It complements the official Plesk Web Application Firewall documentation.

Prerequisites

Section titled “Prerequisites”
  • Administrator access to the Plesk panel.
  • The Noiz custom rule block, from Security/modsec-custom-rules-2026-08-01-v8-annotated.txt in the knowledgebase repository. Paste the whole block, comments included; the parser ignores # lines.

Deploy through the Web Application Firewall

Section titled “Deploy through the Web Application Firewall”

The Plesk Web Application Firewall page is the authoritative channel for the custom rules. Do not edit the generated config file by hand: Plesk regenerates it from the GUI textarea on every save, so a manual edit is overwritten the next time someone saves the WAF settings.

  1. Log in to Plesk as an administrator.
  2. Go to Websites & Domains → the domain → Web Application Firewall.
  3. Open Settings and find the Custom directives textarea.
  4. Paste the whole rule block into the textarea and save.

ModSecurity’s own rule files for Imunify360 live in /etc/apache2/modsecurity.d/rules/custom/ and are managed by Imunify. Do not edit them by hand.

Verify the rules are live

Section titled “Verify the rules are live”

After a change, run from a root shell:

Terminal window
apachectl configtest && systemctl reload apache2
grep -c "id:1000210" /etc/apache2/plesk.conf.d/modsecurity.conf   # must be 1
grep -c "wc-ajax" /etc/apache2/plesk.conf.d/modsecurity.conf      # must be 1

Each grep should return exactly 1: one copy of each rule. More than one means the block was pasted twice, which produces duplicate rule-id errors at reload. Then confirm the rate-limit counters are collecting:

Terminal window
ls /var/cache/modsecurity/          # www-data-ip.dir collections appear with traffic

The per-IP counters are stored on disk and are box-global, so the rate limit is real per-IP enforcement, not per-Apache-worker dilution.

If something is wrong

Section titled “If something is wrong”

If a legitimate visitor is being blocked, or a rule is not firing, see Troubleshooting the Noiz ModSecurity Custom Rules. If you cannot resolve it, contact Noiz support.