Short answer: ConfigServer closed on 31 August 2025, so ConfigServer ModSecurity Control (cmc) is no longer maintained. The replacements are MegaWit Guardian (manages the ModSecurity you already run, with a hit explorer, false-positive tuning, automatic attacker blocking and virtual-patching rule packs, cPanel, Plesk and DirectAdmin), WHM's built-in ModSecurity Tools and Vendors (free, basic), Imunify360 and BitNinja (their own WAFs inside larger suites), Cloudflare WAF (at the edge, in front of the server), and the built-in ModSecurity settings of Plesk and DirectAdmin.
Way to the Web Ltd., the company behind ConfigServer, closed on 31 August 2025. cmc was a free WHM plugin for turning ModSecurity rules on and off per domain or user. It may keep working for a while, but it gets no fixes for new cPanel versions and no support.
Sources: cPanel support, EuroVPS end-of-life notice.
What a cmc replacement needs to cover: disabling a rule for one domain without turning off the whole WAF, seeing what was blocked and why, and — ideally — help with false positives and blocking repeat attackers.
| Option | Type | Per-domain rule control | Hit explorer & false-positive help | Panels | Pricing model |
|---|---|---|---|---|---|
| MegaWit Guardian | Commercial ModSecurity manager | Yes, plus allowlists | Yes: analytics, tuning advisor, automatic attacker blocking, end-user WAF view | cPanel/WHM, Plesk, DirectAdmin | Flat per server, unlimited accounts; 15-day free trial |
| WHM ModSecurity Tools + Vendors | Built into cPanel/WHM | Rule on/off, server-wide | Basic hit list | cPanel only | Included with cPanel |
| Imunify360 WAF | Own WAF inside an all-in-one suite | Yes | Yes | cPanel, Plesk, DirectAdmin and others | Per server, tiered by number of accounts |
| BitNinja WAF | WAF inside a server-security suite | Yes | Yes | Panel-independent | Per server subscription |
| Cloudflare WAF | Edge WAF in front of the server | Per zone (domain) | Yes, in Cloudflare's dashboard | Any, per domain on Cloudflare | Per domain plan |
| Plesk / DirectAdmin ModSecurity | Built into the panel | Plesk: per domain; DirectAdmin: server-wide via CustomBuild | Limited | Plesk or DirectAdmin | Included with the panel |
Competitor details are summarised from each vendor's public documentation as of October 2026; check the vendor for current features and prices.
MegaWit Guardian (MWG) is our product. Unlike suites that swap in their own WAF, it manages the ModSecurity your panel already runs: one-click ModSecurity install, engine and rule-set vendor control, per-domain rule disabling and allowlists, a WAF hit explorer with analytics, a false-positive tuning advisor, one-click and automatic attacker blocking, maintained virtual-patching rule packs, an optional JavaScript bot check (Apache, nginx and LiteSpeed), attack alerts and a weekly report. Hosting customers get a read-only view of the WAF events on their own sites. Runs on cPanel/WHM, Plesk and DirectAdmin; $14.99/month per server.
Best for: hosts that want to keep ModSecurity and OWASP CRS, but tune and understand it without editing config files.
cPanel lets you install rule-set vendors such as OWASP CRS, view recent hits and disable rules server-wide. It covers the basics, but disabling a rule for a single domain still means editing configuration by hand — the gap cmc used to fill.
Imunify360 brings its own WAF rules as part of CloudLinux's suite with firewall and malware scanner. Strong protection, but it replaces your ModSecurity rule set rather than managing it, and pricing grows with the number of accounts.
BitNinja's WAF is part of a panel-independent security suite with shared IP reputation; a fit for mixed fleets.
Cloudflare filters traffic before it reaches the server and is configured per domain in Cloudflare's dashboard. It only protects domains proxied through Cloudflare, so it complements rather than replaces a server-side WAF.
Plesk has a Web Application Firewall page with per-domain rule switches; DirectAdmin installs ModSecurity and OWASP CRS through CustomBuild. Both cover the basics without analytics or tuning help.
No. ConfigServer closed on 31 August 2025, so cmc gets no updates, no fixes for new cPanel versions and no support.
MegaWit Guardian manages the ModSecurity you already run — per-domain rule control, a WAF hit explorer, a false-positive tuning advisor, automatic attacker blocking and virtual-patching rule packs — on cPanel, Plesk and DirectAdmin at one flat per-server price. Imunify360 and BitNinja replace your WAF with their own inside larger suites; cPanel's free ModSecurity Tools cover only the basics.
Yes: WHM's built-in ModSecurity Tools and ModSecurity Vendors pages, and the built-in ModSecurity settings of Plesk and DirectAdmin. They switch rules and vendors on and off but have no per-domain tuning help or analytics.
Find the rule ID in the WAF hit log, then disable that rule for the affected domain only, or allowlist the specific request. MegaWit Guardian does both in one click and suggests which rules are causing false positives.
MegaWit Guardian installs with one command on cPanel/WHM, Plesk and DirectAdmin and adds its panel to each. Imunify360 and BitNinja also support several panels; Cloudflare works per domain in front of any server.
The same shutdown ended cxs, csf/lfd and cmq. Compare cxs alternatives, csf alternatives and cmq alternatives.