ModSecurity is a web application firewall that checks requests to your website and blocks ones that look like attacks, such as SQL injection or malicious uploads. Occasionally it blocks something legitimate. This article shows where to switch it on or off, and the safer way to deal with a false block.
How to tell ModSecurity is blocking something
A legitimate action fails with a 403 Forbidden error (sometimes "Not Acceptable" or a 406). Common examples are saving a page in a page builder, submitting a form with code in it, or a plugin calling your site. The rest of the site works normally.
Turn ModSecurity off or on for a domain
- Log in to cPanel and open Security › ModSecurity.
- Scroll to the list of domains. Under Status, click Off or On next to the domain you want to change.
- To change every domain on your account at once, use the Disable or Enable button for all domains at the top of the page.
Changes take effect straight away.
Don't leave it off
Turning ModSecurity off for a few minutes is a quick way to confirm it's the cause, but leaving it off removes that protection from your whole site. Instead:
- Turn it off briefly and repeat the action. If it now works, ModSecurity was the cause.
- Turn it back on straight away.
- Open a ticket with the exact page address (URL), what you were doing, the time it happened and your IP address (from our What's my IP tool).
- We'll check which rule fired and, where it's safe, adjust it for your site so the action works with protection still on.
Good to know
- ModSecurity works alongside our server-wide security system, BitNinja. If you can't reach the site at all, rather than getting a 403 on one action, your IP may be blocked. See how to get your IP unblocked.
- Keeping WordPress, themes and plugins up to date reduces both real attacks and false blocks.
