ModSecurity with the OWASP Core Rule Set in WHM: setup and false positives

ModSecurity is a web application firewall built into Apache and LiteSpeed. With the OWASP Core Rule Set (CRS) it blocks SQL injection, cross-site scripting and other attacks before they reach PHP. The trade-off is occasional false positives: a legitimate form post or page builder save gets a 403 Forbidden. This guide covers both sides.

Before you start

• Root access to WHM. On MdmHost shared hosting, ModSecurity is managed for you; you can only switch it per domain in cPanel ModSecurity.
• If Imunify360 is installed, its own ModSecurity rules are usually used instead of CRS; see Imunify360 ModSecurity false positives.

Enable the OWASP CRS vendor

1. Go to WHM → Security Center → ModSecurity Vendors.
2. Find OWASP ModSecurity Core Rule Set and click Install. Vendors in general are covered in WHM ModSecurity vendors.
3. Leave Enabled and Updates switched on so rules stay current.
4. In WHM → Security Center → ModSecurity Configuration, set Audit Log Level to Only log noteworthy transactions and Rules Engine to Process the rules. Save.

Find the rule behind a 403

1. Reproduce the error and note the time, domain and your IP.
2. Open WHM → Security Center → ModSecurity Tools → Hits List, or search the log from SSH:
   Copy

   grep 203.0.113.10 /usr/local/apache/logs/modsec_audit.log | tail -n 20

3. Look for the [id "942100"] value and the message, such as SQL Injection Attack Detected via libinjection. Note the URI that was hit.

Fix the false positive

Disable one rule for one domain (preferred)

1. In ModSecurity Tools → Rules List you can disable a rule server-wide. To limit it to one site, add an include for that virtual host instead:
   Copy

   mkdir -p /etc/apache2/conf.d/userdata/ssl/2_4/username/example.com

2. Create modsec.conf in that folder:
   Copy

   <IfModule mod_security2.c>
   SecRuleRemoveById 942100
   </IfModule>

3. Repeat under userdata/std/2_4/... for plain HTTP, then rebuild and restart:
   Copy

   /scripts/rebuildhttpdconf && /scripts/restartsrv_httpd

Disable one rule for one URL

<LocationMatch "/wp-admin/admin-ajax.php">
SecRuleRemoveById 942100
</LocationMatch>

Disable server-wide

In ModSecurity Tools → Rules List, find the rule ID and click Disable. Use this only for rules that misfire on many sites.

Check afterwards

• Repeat the action that failed and confirm it no longer returns 403.
• Watch the hits list for a day. Repeated hits from one IP on LF_MODSEC can also make CSF block that IP; see unblock an IP in WHM CSF.

Next steps

• Enable or disable ModSecurity in cPanel
• Network, host and web application firewalls
• Cloudflare WAF custom rules