Question WAF (ModSecurity)

[WebHostingAce]

Server operating system version

AlmaLinux 8.10 (Cerulean Leopard)

Plesk version and microupdate number

Plesk Obsidian 18.0.75

With the growing security concerns lately, I wanted to ask whether the Comodo (free) ModSecurity rules are still actively maintained and kept up to date?

I’m open to using Atomic Advanced ModSecurity rules, however my understanding is that Atomic Advanced does not support NGINX on Plesk, which is a limitation for my setup.

Given this, what options do we currently have for a well-maintained WAF ruleset that works properly with NGINX + Plesk?

I would appreciate hearing what other users are currently using and recommending.

Thank you.

 

[scsa20]

The ModSecurity rules done by both Comodo and Atomic is managed by Comodo and Atomic respectfully. And as far as I'm aware, they're updated pretty frequently.

 

[ChristophRo]

The Comodo Ruleset does no longer get updates (latest change is from 2023 or so) but still covers all the basics.
You can use the OWASP ruleset, but in my experience this generates way to much false positives on a server with many different sites. (if enabled generally)