Plesk Obsidian Security Hardening & PHP-FPM Optimization for Hosting Providers

Author: Mir Alamin (Principal Web Architect) | Published: July 28, 2026 at 05:00 PM | Reading Time: 21 min read | Category: Security | Tags: Plesk, Web Server, PHP Tune, Hardening, Security, Performance

Executive Summary

Plesk Obsidian is a widely used control panel for managing multi-tenant Linux server environments. However, default Plesk installations leave administrative ports exposed, default PHP handler settings unoptimized, and fail2ban rules unconfigured. For hosting providers and digital agencies running multi-client infrastructure on Plesk, implementing proper security isolation and PHP-FPM tuning is mandatory to prevent cross-account contamination and server resource exhaustion.

This security and performance hardening guide covers restricting Plesk admin access, tuning PHP-FPM event handlers, and enabling ModSecurity web application firewall (WAF) rules in Plesk Obsidian.

1. Restricting Plesk Admin Panel Access (Port 8443)

Secure the Plesk control panel interface (port 8443) by restricting login access strictly to authorized administrative IP addresses via firewall rules.

# Add UFW rule to allow port 8443 strictly from trusted admin IP
sudo ufw allow from 198.51.100.50 to any port 8443 proto tcp
sudo ufw deny 8443/tcp

Disable root password authentication for Plesk SSH access in /etc/ssh/sshd_config and mandate two-factor authentication (2FA) via the Plesk 2FA extension.

2. Enabling OWASP ModSecurity WAF Rules in Plesk

Protect hosted client websites from SQL injection, cross-site scripting (XSS), and file inclusion attacks by activating ModSecurity with OWASP Core Rule Set (CRS).

Step-by-Step Activation in Plesk Obsidian:

Navigate to Tools & Settings > Web Application Firewall (ModSecurity).
Set rule mode to On (Blocking).
Select OWASP ModSecurity Core Rule Set (CRS) or Comodo WAF.
Set predefined set to Thorough.

3. Optimizing PHP-FPM Memory Limits across Plesk Service Plans

To prevent a single runaway website from crashing shared Plesk instances, configure per-domain PHP-FPM process limits under Service Plans:

; Plesk Additional PHP Directives per Domain
memory_limit = 256M
max_execution_time = 60
upload_max_filesize = 32M
post_max_size = 32M
opcache.enable = 1
opcache.memory_consumption = 128

Switch default PHP handlers from Apache cgi or fastcgi to Dedicated PHP-FPM served directly by Nginx for maximum performance.

4. Managed Server Security & Troubleshooting Services

If your Plesk or Linux server requires security audits, malware purging, or diagnostic tuning:

🔒 Website Hack Recovery & Security Hardening Services
⚙️ Managed Server Administration Plans
🔧 Website & Server Troubleshooting Services

5. Frequently Asked Questions (FAQ)

Q1: Should I run PHP as Apache or Nginx handler in Plesk?

Always select "PHP-FPM application served by Nginx". This completely bypasses Apache processing for static files and executes PHP scripts with significantly lower latency.

Q2: What should I do if ModSecurity blocks legitimate client form submissions?

Check Plesk ModSecurity logs under Tools & Settings > WAF Logs, identify the specific Rule ID triggering the false positive, and add that Rule ID to the Security Rule IDs Exclusion List.

Plesk Obsidian Security Hardening & PHP-FPM Optimization for Hosting Providers

Mir Alamin