Skip to main content
🎉 Enterprise for €149.50/year: pay for 10 months, get 12. That's €12.46/mo per server.Get 2 Months Free
OpenPanelDocumentation
Version: 2.0.15

CorazaWAF

opencli waf command can be used to enable/disable CorazaWAF on the server, enable/disable WAF per domain, view rules, view statistics, etc.

Status​

opencli waf status
Example output
# opencli waf status
CorazaWAF is ENABLED

Enable​

To enable the WAF and ensure it is used for new domains, run:

Response body inspection is turned off (SecResponseBodyAccess Off in /etc/openpanel/caddy/coraza_rules.conf), since buffering every HTML page for the CRS data-leakage checks adds around 230 ms per page.

This also disables OWASP CRS rulesets for stacks OpenPanel doesn't use or rarely hosts, by renaming them to .conf.disabled: REQUEST-944-APPLICATION-ATTACK-JAVA, RESPONSE-952-DATA-LEAKAGES-JAVA, RESPONSE-954-DATA-LEAKAGES-IIS and RESPONSE-956-DATA-LEAKAGES-RUBY. They can be re-enabled from OpenAdmin > Security > CorazaWAF.

WAF is turned on for all existing domains, except domains of users that have it turned off with opencli waf user USERNAME disable.

It also downloads the official OWASP CRS rule exclusion plugins for WordPress, Drupal, Nextcloud, DokuWiki, phpBB, XenForo and phpMyAdmin into /etc/openpanel/caddy/coreruleset-plugins/. Users can turn these on per domain as App profiles in OpenPanel > WAF, so the app's normal requests are not blocked as false positives.

opencli waf enable
Example output
# opencli waf enable
Downloading Coraza rules..
...
Downloading OWASP CRS..
Cloning into '/etc/openpanel/caddy/coreruleset'...
Disabling rulesets not used by the stack..
- Disabled ruleset REQUEST-944-APPLICATION-ATTACK-JAVA
- Disabled ruleset RESPONSE-952-DATA-LEAKAGES-JAVA
- Disabled ruleset RESPONSE-954-DATA-LEAKAGES-IIS
- Disabled ruleset RESPONSE-956-DATA-LEAKAGES-RUBY
Downloading CRS plugins for app profiles..
- Installed plugin wordpress-rule-exclusions
- Installed plugin drupal-rule-exclusions
...
Enabling WAF module..
Setting container image 'openpanel/caddy-coraza'..
Restarting Web Server to use the new image with CorazaWAF..
...
CorazaWAF is ENABLED

Disable​

To completely disable the WAF for all existing domains (including domains in monitor only mode) and prevent it from being applied to new domains, run:

opencli waf disable
Example output
# opencli waf disable
Checking if CorazaWAF is used by any user domains..
WARNING: WAF is still active on some domains:
 - example.com
 - example.net
Do you really want to disable WAF protection on these domains and stop using Coraza WAF on the server? [y/N]: y
Disabling Coraza WAF...
Disabling WAF module...
CorazaWAF is DISABLED: 'waf' module is not enabled in OpenAdmin > Settings > Modules.)

Add -y to skip the confirmation prompt:

opencli waf disable -y
Example output
# opencli waf disable -y
Checking if CorazaWAF is used by any user domains..
WARNING: WAF is still active on some domains:
 - example.com
 - example.net
Disabling Coraza WAF...
Disabling WAF module...
CorazaWAF is DISABLED: 'waf' module is not enabled in OpenAdmin > Settings > Modules.)

Domain​

Status​

Check if CorazaWAF is enabled (On), disabled (Off) or in monitor only mode (DetectionOnly) for domain:

opencli waf domain <DOMAIN_NAME>
Example output
# opencli waf domain example.com
SecRuleEngine is set to On for domain example.com

Enable​

Enable WAF for a domain:

opencli waf domain <DOMAIN_NAME> enable
Example output
# opencli waf domain example.com enable
SecRuleEngine On is now set for domain example.com

Disable​

Disable WAF for a domain:

opencli waf domain <DOMAIN_NAME> disable
Example output
# opencli waf domain example.com disable
SecRuleEngine Off is now set for domain example.com

Monitor only​

Check and log requests for a domain without blocking anything (SecRuleEngine DetectionOnly). Turn blocking back on with enable:

opencli waf domain <DOMAIN_NAME> monitor
Example output
# opencli waf domain example.com monitor
SecRuleEngine DetectionOnly is now set for domain example.com

App profiles​

Show the protection level (compatibility, standard, strict, or custom when edited by hand) and the app profiles (CRS plugins) turned on for a domain:

opencli waf domain <DOMAIN_NAME> plugins
Example output
# opencli waf domain example.com plugins
Protection level for domain example.com: standard
App profiles active for domain example.com:
 - wordpress

User​

Users can have CorazaWAF turned off for all their domains, including domains they add later. Turning it off creates /home/<CONTEXT>/waf.disabled, and opencli domains-add sets SecRuleEngine Off for new domains of that user while the file exists.

Status​

Check if CorazaWAF is used for new domains of a user and show the status of each of their domains:

opencli waf user <USERNAME>
Example output
# opencli waf user stefan
CorazaWAF is enabled for new domains of user stefan
SecRuleEngine is set to On for domain example.com
SecRuleEngine is set to Off for domain example.net

Enable​

Enable CorazaWAF for all current and new domains of a user (sets SecRuleEngine On, monitor only domains too). If the waf module is not enabled, only the user's waf.disabled file is removed and existing domains are left as they are:

opencli waf user <USERNAME> enable
Example output
# opencli waf user stefan enable
- SecRuleEngine On is now set for domain example.com
- SecRuleEngine On is now set for domain example.net
CorazaWAF is now enabled for all current and new domains of user stefan

Disable​

Disable CorazaWAF for all current and new domains of a user:

opencli waf user <USERNAME> disable
Example output
# opencli waf user stefan disable
- SecRuleEngine Off is now set for domain example.com
- SecRuleEngine Off is now set for domain example.net
CorazaWAF is now disabled for all current and new domains of user stefan

Plugins​

List the CRS rule exclusion plugins, whether each is installed and on how many domains it is turned on:

opencli waf plugins
Example output
# opencli waf plugins
PLUGIN         STATUS     DOMAINS
wordpress      installed  3
drupal         installed  0
nextcloud      installed  1
dokuwiki       installed  0
phpbb          installed  0
xenforo        installed  0
phpmyadmin     missing    0

Install​

Download any missing plugins, for example on servers where WAF was enabled before plugins were added:

opencli waf plugins install
Example output
# opencli waf plugins install
- Installed plugin phpmyadmin-rule-exclusions

Update​

Update OWASP CRS and the CRS plugins, then reload Caddy:

opencli waf update

Rulesets disabled with a .conf.disabled file stay disabled after the update, even if the update brings back the original file.

Example output
# opencli waf update
- Excluding disabled ruleset rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf
...
Updating OWASP CRS..
- Kept ruleset RESPONSE-952-DATA-LEAKAGES-JAVA.conf disabled
Update successful.
Updating CRS plugins..
- Updated plugin dokuwiki-rule-exclusions
- Updated plugin drupal-rule-exclusions
...

Update Log​

View update log for OWASP CRS:

opencli waf update log
Example output
# opencli waf update log
3f2c1a9 Merge pull request #4012 from coreruleset/fix-942440-fp
8d71b0e fix(942440): reduce false positives
...

IDs​

List all rule IDs from all enabled sets:

opencli waf ids
Example output
# opencli waf ids
/etc/openpanel/caddy/coreruleset/rules/REQUEST-901-INITIALIZATION.conf:901001
/etc/openpanel/caddy/coreruleset/rules/REQUEST-901-INITIALIZATION.conf:901100
...

Tags​

List all rule tags from all enabled sets:

opencli waf tags
Example output
# opencli waf tags
/etc/openpanel/caddy/coreruleset/rules/REQUEST-913-SCANNER-DETECTION.conf:application-multi
/etc/openpanel/caddy/coreruleset/rules/REQUEST-913-SCANNER-DETECTION.conf:attack-reputation-scanner
...

Stats​

Get stats from the log.

Country​

opencli waf stats country
Example output
# opencli waf stats country
    2000 US
    1501 DE
    1033 BE
     809 SG
     705 SC
     606 ID
     603 IN
     505 NL
     500 RS
     209 CH
     109 FR
     108 PY
     102 BG
      70 CA

IP​

opencli waf stats ip
Example output
# opencli waf stats ip
   11069 154.83.103.102
    9038 154.83.103.15
    9038 154.83.103.111
    9038 154.83.103.106
    7007 154.83.103.19
    7007 154.83.103.109
    4069 154.83.103.202
    4069 154.83.103.10
    4062 108.162.221.121
    4055 154.83.103.14

Path​

opencli waf stats path
Example output
# opencli waf stats path
    1308 /modules/younitedpay/logo.png
     707 /.git/config
     608 /.env
     304 /.git/HEAD
     301 /wp-content/plugins/WordPressCore/include.php
     301 /php/how-to-fix-file_get_contents-wrapper-is-disabled-error-in-php/
     204 /wp-includes/images/include.php
     203 /wp-includes/widgets/include.php
     201 /.aws/credentials
     109 /wp-content/themes/include.php

Agent​

opencli waf stats agent
Example output
# opencli waf stats agent
   10400  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36
    1909  Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
    1308  Go-http-client/2.0
     809  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0
     702  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36
     610  Mozilla/5.0 (Windows NT 10.0; WOW64) Gecko/20060309 Firefox/22.0
     600  Mozilla/5.0 (Macintosh; Intel Mac OS X 11_8_4) Gecko/20052101 Firefox/22.0
     544  Mozilla/5.0
     371  Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0
     350  Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 10.0; Trident/5.0; WOW64)

Hourly​

opencli waf stats hourly
Example output
# opencli waf stats hourly
     14 2025/04/14 00
     14 2025/04/14 10
      7 2025/04/14 19
      7 2025/04/15 18
      7 2025/04/15 22
      7 2025/04/16 00
     14 2025/04/16 10
     14 2025/04/16 11
      7 2025/04/17 04
      7 2025/04/17 07
      7 2025/04/17 12
      7 2025/04/18 01
      7 2025/04/18 06
      7 2025/04/18 07
      7 2025/04/18 10
      7 2025/04/18 19
    469 2025/04/20 07
     14 2025/04/20 08
      7 2025/04/20 14
     14 2025/04/20 18
      7 2025/04/21 15
     14 2025/04/22 05

Request​

opencli waf stats request
Example output
# opencli waf stats request
    1803 POST /xmlrpc.php HTTP/1.1
    1408 POST /xmlrpc.php HTTP/2.0
    1038 GET /modules/younitedpay/logo.png HTTP/2.0
     608 GET /.git/config HTTP/1.1
     641 GET /.env HTTP/1.1
     553 POST /api/discussions/137 HTTP/1.1
     334 POST /api/discussions/128 HTTP/1.1
     324 GET /.git/HEAD HTTP/1.1
     301 POST /wp-comments-post.php HTTP/1.1
     214 POST //xmlrpc.php HTTP/2.0

Count​

Display total number of records in the WAF audit log:

opencli waf count
Example output
# opencli waf count
12408
Previous
Version
Next
Websites
Was this helpful?