ModSecurity is a web application firewall (WAF) that runs in front of your website. It inspects every request and blocks common attacks such as SQL injection, cross-site scripting, malicious bots and login brute force. Occasionally it blocks a legitimate action too, for example saving a page builder layout or submitting a form with code in it. cPanel lets you switch it off per domain to confirm whether it is the cause.
Before you start
- Access to cPanel.
- The exact URL and time of the failing action. You will need them if you ask support to whitelist a rule.
Signs that ModSecurity is blocking you
- A 403 Forbidden, 406 Not Acceptable or Not Acceptable! An appropriate representation… page when you save or submit something.
- The same action works for other people or after a few minutes, but fails again when repeated.
- Your IP is blocked repeatedly after triggering rules many times (the firewall reacts to the ModSecurity hits).
Disable ModSecurity for one domain
- Open cPanel → Security → ModSecurity.
- Find the domain in the Configure Individual Domains list.
- Click Off next to it. To switch it off for every domain at once, use Disable All at the top.
- Repeat the failing action within a few minutes.
If it now works, ModSecurity was the cause. If it still fails, the problem is elsewhere: turn ModSecurity back on immediately.
Turn it back on
Return to cPanel → Security → ModSecurity and click On next to the domain (or Enable All). Do not leave a public site without the WAF; automated attacks start within hours.
Important: Leaving ModSecurity disabled is not a fix. Update the plugin or theme that triggers the rule, or open a ticket with the URL, your IP and the time so we can whitelist only the specific rule for that path.
Troubleshooting
- The ModSecurity icon is missing: the server administrator controls it in WHM; ask support.
- Blocked only in the WordPress editor: update WordPress, the page builder and security plugins first; many old versions send requests that look like attacks.
- Your IP keeps getting blocked: check your public IP and send it to support so we can see which rule fires.