ModSecurity: investigate blocks and false positives

ModSecurity is a web application firewall: it applies rules to requests to detect and block certain attack patterns. Its behaviour depends on the server's rule set and configuration.

A 403 error does not prove that ModSecurity is the cause. It can also come from permissions, authentication, the application or another protection. Before changing anything, link the failure to the corresponding event.

What details to provide

Write down the domain, URL, time with time zone, the IP you tested from and the action that fails. If you have the rule or event ID, include it. Describe how to reproduce it with test data; do not share passwords, tokens or sensitive request bodies.

The full audit log may require access by the server administrator. If it is not visible in cPanel, contact us so we can check the event. Do not guess the rule from a generic browser message.

Fix a false positive

Once confirmed, it is best to adjust only the affected rule and path or parameter. A broad exception can leave other requests unprotected. Check that the legitimate operation works again and that the exception covers no more than necessary.

Do not add exclusions by guesswork or disable the whole WAF as a permanent solution. The cPanel ModSecurity interface lets you enable or disable it per domain, depending on the features available; it is not an editor for specific exceptions.

If a temporary test is needed

Coordinate the test, limit traffic where possible and decide in advance how to re-enable the protection. Reproduce the operation only once and re-enable the protection immediately, even if the failure persists. When you finish, check that the domain is protected again and keep the result to investigate the real cause.