The Imunify360 web application firewall (WAF) uses ModSecurity rules to stop attacks such as SQL injection and code injection before they reach your site. Occasionally a legitimate request, such as saving a post that contains code samples, looks like an attack and is blocked with a 403 Forbidden or 406 Not Acceptable error.
Before you start
- The exact URL and action that fails, and the time it happened.
- Your IP address from the IP checker.
Is it the WAF?
Signs that ModSecurity blocked the request:
- The error appears only for one action, such as saving a specific post, submitting a form with certain text, or uploading a file.
- Other pages work, and the same action works with different content.
- The page says Forbidden, Not Acceptable or mentions Mod_Security.
- After several blocks your IP may get a CAPTCHA (see WebShield).
If every page gives 403, the cause is more likely file permissions or an .htaccess rule (see .htaccess on LiteSpeed).
Common triggers
| Action | Why it triggers |
|---|---|
Saving posts with code, SQL or <script> tags | Looks like injection |
| Page builder saves with very large payloads | Unusual request size or encoding |
Plugin settings that store URLs with ../ or /etc/ | Looks like path traversal |
| Forms where users paste command examples | Looks like command injection |
Fix it
- Try again once to make sure it repeats.
- Note the full URL, the time (with your time zone) and your IP.
- Open a support ticket with those details. MdmHost finds the matching rule ID in the server logs.
- If the request is legitimate, we add a narrow exception for that rule on that URL or domain, rather than disabling the WAF.
Tip: While you wait, a quick workaround for content editors is to save the post without the code sample, then add it in a code block using a different format, such as uploading it as a file.
Why not just disable ModSecurity?
The WAF blocks thousands of automated attacks every day against WordPress, Joomla and other apps. Turning it off for a whole domain removes that protection; a narrow exception keeps it for everything else. Customers cannot switch ModSecurity off themselves on MdmHost for this reason.
For developers
- Send structured data as JSON with the right
Content-Type; raw encoded blobs are more likely to trigger rules. - Avoid query strings that contain SQL keywords or file paths.
- Test plugins on staging and report blocked endpoints early.
For other security tools on the server, see the Imunify360 overview.
Frequently asked questions
Will my IP be blocked after a WAF hit?
A single hit usually only blocks that request. Many hits in a short time can grey-list your IP, which shows a CAPTCHA.
Do WAF exceptions affect other customers?
Exceptions are made as narrow as possible, usually for one domain and URL, so other sites keep full protection.
Why did it start after an update?
Rule sets are updated regularly to catch new attacks. A new rule can match a pattern your site uses; report it and it can be tuned.