Check the actual protection capability
Open EPAdmin Emaila Security Aid with the correct security grants. Read registered/observed state for each protection. Firewall, SSH, WAF and malware controls remain separate; enabling one does not certify the others. A country/threat-feed card explicitly says not implemented.
Per-website WAF policy
Choose a managed website whose status is observed or not configured. Review supported enforcement mode, paranoia level and approved rule exceptions. The typed policy includes website_id, mode, paranoia_level and sorted excluded_rule_ids. The source limits exceptions to 16 approved IDs in its validated rule range, excluding disallowed blocking-evaluation groups. Use the actual offered list rather than uploading arbitrary ModSecurity text.
Request the protected security preview, inspect affected site/configuration and exact confirmation, then submit the durable operation. Confirm read-back and test expected allowed/denied requests against the actual website. A broad exception can reduce protection; retain a reviewed reason and limit it to the supported policy.
Malware scan and findings
Select the authorized managed account/website and supported scan action. Inspect recent scans and recorded findings. A finding is evidence to review, not automatic proof that customer content can be deleted. Quarantine/recovery actions require the existing typed impact and ownership checks. Do not copy suspected payloads into the trusted Panel page or attach private files to public support.
Logs and role separation
GET /v1/security/website-protection returns scoped protection status. Security alerts/login activity are separately filtered by category grants. Customer website access does not grant server security management. A general Customer ModSecurity toggle, hotlink/leech protection, directory privacy and IP blocker are unavailable menu features; the Admin WAF implementation does not make them available to Customers.
Verify and troubleshoot
After the job, reload protection state, inspect the exact website and run harmless approved acceptance probes. Distinguish scan completion, findings and actual remediation. If capability, policy validation or host registration is missing, retain unavailable state. Do not disable confinement or install incompatible rule packages manually. Generic ModSecurity Rules editing and Security Advisor are not implemented, and source policy tests are not a complete production security certification.