Repository navigation
WAF UX Suggestion #1156
Replies: 4 comments 7 replies
|
I like the profiles idea, but it's one more thing to maintain which I can't do right now. I'll definitely add it to the roadmap to be implemented in the future |
|
update: OWASP team already maintains profiles for popular apps: https://github.com/coreruleset/plugin-registry#owasp-crs-plugin-registry so this can be hooked really well with 0 maintenance from our side - just regularly updating the rule files they edit. |
|
added for 2.0.13 update: 
and updated the docs: https://openpanel.com/docs/panel/security/waf/ hope i covered everything you mentioned for this page, once again thank you for your suggestions! |
|
Wow, This is perfect. yes, it covers everything. Good job 👍 |
I've been unable to apply profile, is it something I have to turn on from openadmin because openpanel is not showing any profile even though I have one Wordpress website installed |
|
profiles are NOT auto-applied, only recommendation message is shown on that page when cms detected and profile is not set |
|
I thought maybe it only detects for new installations, I tried installing fresh Wordpress and it's the same thing, no profile shows, which makes me think I might be missing something |
|
this should have installed the profiles for you, let me test update again.. OpenPanel/UPDATES/2.0.13/UPDATE.sh Lines 4 to 5 in 6aea42c |
|
on demo they sjhow immediately, but there is an extra step there to restart user panel, so probably just that is missing here as profiles are downlaoded after panel startup and ar enot visible to it - run: and they should show immediately. if they do not, please share output of |
|
|
Uh oh!
There was an error while loading. Please reload this page.
I have a suggestion for the customer-facing WAF page.
Currently, the WAF page is quite minimal:
Since OpenAdmin already provides the more advanced Coraza WAF management, including rule sets and individual rules, I think the WAF page in OpenPanel could be simplified and made more user-friendly for customers.
Most hosting customers probably won't know what
SecRuleRemoveByID, rule IDs, or rule tags mean, or when they should use them.Perhaps the customer-facing WAF could have something more like:
Web Application Firewall
🟢 WAF Enabled
Security Profile
Since OpenPanel already knows which application is installed on a domain, it could potentially automatically select the appropriate profile. For example, if WordPress is detected, OpenPanel could automatically use the WordPress profile.
There could also be a simple protection level:
with a short explanation of what each does.
The page could then focus on what customers actually need:
The existing Disabled IDs and Disabled Tags could remain under an Advanced Settings section for users who understand Coraza and need direct control.
One feature that could make this especially useful
When a legitimate request is blocked, the WAF log could show the rule that caused the block and provide an easy way to create an exception.
For example:
The customer could then exclude that specific rule for the domain instead of having to find the rule ID and manually enter:
SecRuleRemoveByID 942100This would create a much simpler workflow:
Request blocked → View event → Understand why → Create exception
rather than requiring the customer to understand how Coraza rules work.
Since OpenPanel already supports applications such as WordPress, Joomla, Drupal, Nextcloud, phpBB, OpenCart, PrestaShop, Moodle, etc., I think application-specific WAF profiles could also be something that grows alongside the application support.
The goal would be to keep the full Coraza configuration available to administrators in OpenAdmin while giving normal hosting customers a much simpler and safer WAF interface in OpenPanel.
All reactions