Managed WAF

The managed WAF puts ModSecurity with the OWASP CRS (Core Rule Set) in front of your sites to block common web attacks — SQL injection, XSS, LFI, RCE, and more — right at Nginx. Per-site WAF is a Pro feature; the per-source firewall is available on every plan.

Enable the WAF (Pro)

The engine installs in one click. Open a site’s Firewall tab and install ModSecurity:

• MZPanel ships a custom-compiled Nginx, so the connector is built against this box’s exact Nginx version (with --with-compat). The build only produces a module; your running Nginx is untouched until the next reload.
• Once installed, you turn the WAF on per site. Each site gets its own rule file included into its Nginx server block, so settings don’t leak between sites.

Tip

The WAF is per site, not per box — enable it where you need it and leave low-risk sites alone.

Modes — detect vs. block

The WAF runs in one of three modes:

Mode	Behavior
Off	No inspection.
Detect (learning)	Matches are logged only — traffic passes. Use this to surface false positives before enforcing.
Block	Malicious requests are rejected with 403.

Caution

False positives are the biggest risk with a WAF in front of WordPress/WooCommerce. Start in detect mode, watch the logs, then switch to block once you’re confident legitimate traffic — like wp-admin logins — isn’t being caught. A matching request (for example ?id=1' OR '1'='1) is logged in detect mode and returns a 403 in block mode.

Malware scanning (ClamAV)

MZPanel scans site webroots for malware and web shells with ClamAV. Detected files are moved to quarantine (outside the webroot) rather than deleted — MZPanel never auto-cleans or rewrites your files, so a false positive can’t break your site. From the panel you restore or delete quarantined files yourself.

Not yet available

Scheduled maldet (Linux Malware Detect) signature scans are planned but not yet shipped. On-demand ClamAV scanning and quarantine work today.

Firewall rules

Independently of the WAF, MZPanel manages a per-source firewall (Free) so you can allow or block traffic by IP or CIDR. This is the same mechanism used to grant a specific source IP access to a remote database, and it folds into the server’s Security view alongside login-attempt history.