Fix "proxy_lock refused proxy backend" errors on Plesk 18.0.82

On 3 November 2026 Plesk shipped 18.0.82 Update 2 and 18.0.81 Update 7. The change log marks both as fixing "a critical security issue" on Linux, with no CVE published, and warns that the update changes the virtual host templates and regenerates the web server configuration of every domain. A new Apache module, mod_proxy_lock (package plesk-mod_proxy_lock), arrived alongside it. Domains that proxy to a Tomcat or Lucee backend over AJP, or to an app over a Unix socket, started failing straight after.

This guide is for Plesk admins running Java, CFML, or socket-based apps behind Apache. Install the update anyway. The fix is to give the lock what it needs, not to roll back.

What mod_proxy_lock does

Plesk staff describe it on the forum as restricting a domain's proxy connections to the sockets you specify. Plesk writes a ProxyLockSocket directive into each vhost pointing at that domain's PHP-FPM socket. Any other backend is refused. Three behaviours matter:

• HTTP and HTTPS backends are allowed on purpose. ProxyPass / http://127.0.0.1:8080/ keeps working.
• AJP is blocked. Plesk first called the lock intentional, then committed to a fix in the next update so AJP works without extra configuration.
• HTTP over a Unix socket is blocked, for example unix:/path/app.sock|http://127.0.0.1/. Plesk says these "should be allowed". The fix is in the same pending update.

ProxyLockSocket only accepts none or an absolute Unix socket path. An ajp:// value fails the config test.

Confirm it is the lock

Check the domain's Apache error log, the generated vhost, and the config test:

grep proxy_lock /var/www/vhosts/system/example.com/logs/error_log | tail
grep -rn ProxyLockSocket /var/www/vhosts/system/example.com/conf/
apachectl configtest

A line like proxy_lock: refused proxy backend ajp://localhost:8009 confirms it. At least one report shows the browser getting a 403 rather than a 502, which is why the problem can look like a permissions issue. If you're getting 502s instead, use the Plesk 502 decision tree.

Fix by backend type

Tomcat over AJP: switch to the HTTP connector

The cleanest fix also outlasts the bug. Point Apache at Tomcat's HTTP connector instead of AJP. Under Websites & Domains » example.com » Apache & nginx Settings, replace the ProxyPass ajp://… lines in the additional directives with:

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:8080/
ProxyPassReverse / http://127.0.0.1:8080/

Bind the Tomcat HTTP connector to 127.0.0.1 so it isn't reachable from outside. Don't rely on the firewall for that.

FastCGI over a Unix socket

Add the app's socket to the lock, wrapped so the config still loads if the module is off:

<IfModule mod_proxy_lock.c>
    ProxyLockSocket "/var/www/vhosts/example.com/application.sock"
</IfModule>

AJP you can't change, or HTTP over a Unix socket

Mod_cfml for Lucee is one example. There's no directive-level fix for either until Plesk ships the updated module. You have three options:

1. Wait for the next Plesk update if the site can stay down or run on a fallback.
2. Install Plesk's test build. Staff posted patched module packages for AlmaLinux 8, AlmaLinux 9, and Ubuntu 24.04 in the forum thread. Users report they fix AJP. One user reports the 4 November Ubuntu build doesn't fix HTTP over a Unix socket. Official updates replace it automatically. One admin found the LoadModule line commented out after installing, so check /etc/httpd/conf.d/proxy_lock.conf.
3. Disable the module on the server, as a last resort:

plesk sbin httpd_modules_ctl -d proxy_lock
systemctl restart httpd

This removes the check for every domain, not just the broken one. Re-enable it with -e proxy_lock once the fixed update lands. Make it a ticket with a date, not a permanent setting.

Don't hand-edit the generated configs

Files under /var/www/vhosts/system/*/conf/ are regenerated from templates. This update proved it by rebuilding all of them. Keep fixes in the per-domain additional directives or in custom templates. If you use custom templates, compare them against the new defaults now. The Plesk repair utility guide covers how to rebuild configs safely when they drift.

Next steps

• Plesk Obsidian 18.0.82 release notes — the rest of what changed in this branch.
• Fix Plesk update failures — if the update itself didn't apply cleanly.
• Running Plesk without a current license, or adding servers? See the Plesk license page or compare editions.