ModSecurity is the web application firewall built into cPanel's web stack. It inspects HTTP requests and blocks common attacks against PHP applications. On its own it does nothing: you add a rule set from a vendor. This guide covers vendors, rule management and false positives.
On MdmHost hosting plans this is managed for you. This guide is for administrators of their own cPanel server with root access.
Before you start
- Root access to WHM.
- ModSecurity installed through EasyApache 4 (the
mod_security2package) or LiteSpeed, which reads the same rules (see EasyApache 4). - If you run Imunify360, it provides its own WAF rule set; do not stack a second large vendor on top of it (see Imunify360 setup).
Add a rule vendor
- Go to WHM → Security Center → ModSecurity Vendors.
- Install OWASP ModSecurity Core Rule Set (or a commercial vendor) by clicking Install, or add a vendor by URL.
- Enable the vendor and turn on automatic updates.
Global settings
In WHM → Security Center → ModSecurity Configuration:
- Rules Engine: Process the rules to block; Process the rules in verbose logging mode and do not execute disruptive actions to only log while you tune.
- Audit Log Level: log only relevant (blocked) requests to save disk.
- Connections Engine: keep defaults unless needed.
Tip: Start new vendors in detection-only mode for a few days, review hits, then switch to blocking.
Review hits
- Go to WHM → Security Center → ModSecurity Tools.
- The Hits List shows time, IP, domain, rule ID and message.
- Click a hit for the full request details.
Handle false positives
- Note the rule ID from the hit list.
- Prefer a narrow fix: in ModSecurity Tools → Rules List, disable the rule only if it is broken for everyone; otherwise add an exception for one domain.
- Per-domain control is available in WHM → Security Center → ModSecurity Domain Manager (turn ModSecurity off or on for a domain), and users can toggle it in cPanel if allowed (see ModSecurity in cPanel).
Warning: Turning ModSecurity off for a whole domain removes all protection from it. Use it only temporarily while you add a precise exception.
The user-side explanation of WAF blocks is in 403 errors from ModSecurity.
Troubleshooting
Every request is blocked after enabling a vendor
A rule conflicts with your stack. Switch to detection-only, find the rule in the hit list and disable it.
Hits list is empty
The engine is off, audit logging is disabled, or no vendor is enabled.
Frequently asked questions
Does ModSecurity slow sites down?
Large rule sets add a small delay to each request. A well-tuned vendor set is usually unnoticeable compared with the protection it gives.
Which vendor should I choose?
OWASP CRS is free and widely used. Commercial vendors and Imunify360 offer rules tuned for hosting with fewer false positives.
Can resellers change ModSecurity?
No. ModSecurity configuration is root-only. Users may get a per-domain toggle in cPanel if you allow it.