Imunify360 Under Attack Mode (UAM) unavailable when WebShield runs as a reverse proxy

Issue

Under Attack Mode (UAM) is not available on a server that otherwise appears to meet the prerequisites. Running imunify360-wsctl filters lists the uam filter as no, so UAM cannot be enabled and no UAM rules can be created.

# imunify360-wsctl filters
FILTER   AVAILABLE  DESCRIPTION
verdict  yes        IPSET lookup
uam      no         Under Attack Mode
l7prot   no         L7 rate limiter

The same condition appears in a second form: UAM rules are already created and their hit counters increase, but the traffic is never challenged and the sites stay under load:

# imunify360-wsctl uam list
ID  OWNER  ACTIVE  DOMAIN         COOKIE_TTL  LABEL
1   admin  true    example.com    1h          FIRE!

# imunify360-wsctl uam counters
ID  ACTIVE  DOMAIN         HITS  LABEL
1   true    example.com    1566  FIRE!

Restarting the WebShield service (systemctl restart imunify360-webshield) does not change the result.

Environment

• Imunify360
• WebShield (imunify360-webshield-bundle 1.45.0 or newer)
• cPanel with Apache, or Nginx with the WebShield dynamic module loaded
• Not applicable where LiteSpeed or OpenLiteSpeed is installed, or where the server runs a control panel other than cPanel
• CloudLinux OS, AlmaLinux, or another RHEL-based distribution

Solution

UAM requires WebShield to run in Apache module mode. On existing installations, WebShield often runs as a reverse proxy, which has to be switched manually.

1. Confirm the server is eligible. Run imunify360-wsctl status and check the platform flags:

   "is_cpanel": true,
   "has_apache": true,
   "modules_supported": true

   All three must be true. If modules_supported is false (for example, LiteSpeed / OpenLiteSpeed is installed, or the server runs DirectAdmin or no supported panel), UAM cannot be enabled, and there is no workaround.

2. Switch WebShield into Apache module mode:

   imunify360-agent config update '{"WEBSHIELD":{"mode":"module"}}'

3. Verify the switch took effect:

   imunify360-wsctl status    # expect "modularity_mode": "apache" and "module": { "loaded": true }
   imunify360-wsctl filters   # the uam filter should now show "yes"

4. Enable the UAM service, then create per-domain rules as described in the documentation:

   imunify360-wsctl uam settings service enable

Note: switching the mode changes how WebShield handles traffic (from a reverse proxy to an Apache module), so perform it during a low-traffic window and confirm the sites load normally afterwards. To revert, run:

imunify360-agent config update '{"WEBSHIELD":{"mode":"proxy"}}'

If UAM is still unavailable

When imunify360-wsctl status reports "modules_supported": false, the module cannot be loaded and changing the WebShield mode does not help: the configuration accepts "webshield_mode": "module" while "modularity_mode" stays standalone and "module": { "loaded": false }.

On a cPanel server with Apache, "modules_supported": false usually means LiteSpeed or OpenLiteSpeed is installed on the machine, even when Apache is the active web server and LiteSpeed is stopped. LiteSpeed is installed by its own installer rather than as a system package, so it does not appear in rpm -qa. Check the filesystem instead:

ls -d /usr/local/lsws
/usr/local/lsws/bin/lshttpd -v

If /usr/local/lsws exists and lshttpd -v reports a LiteSpeed or OpenLiteSpeed version, that is what makes the WebShield module unsupported on the server.

The ea-phpXX-php-litespeed packages and mod_lsapi are PHP handlers for Apache, not the LiteSpeed web server, and they do not block the switch.

Cause

UAM and the L7 rate limiter require a WebShield dynamic module loaded into the web server. When WebShield runs as a reverse proxy (webshield_mode: proxy, modularity_mode: standalone), no module is loaded, so it only sees traffic already filtered by the IP lists (graylist / splash / blacklist) where the verdict is already known. In that arrangement, UAM is not applicable, and imunify360-wsctl filters reports uam no.

New installations default to Apache module mode, while existing installations frequently remain in reverse-proxy mode until the mode is switched manually. The switch is only possible when the module is supported on the server (modules_supported: true), which excludes LiteSpeed / OpenLiteSpeed and non-cPanel setups.

Useful links

• Under Attack Mode (documentation)
• WebShield feature availability (imunify360-wsctl filters)