# Disable ModSecurity
Source: https://docs.webgee.com/en/security-ssl/disable-modsecurity



Disable ModSecurity for a domain. Applies to shared, reseller and Premium
hosting.

ModSecurity is a web application firewall that inspects requests and blocks those
matching known attack patterns. It occasionally blocks legitimate ones —
typically a page editor, a file upload, or a form containing something that
resembles SQL.

The symptom is a **403 Forbidden** on an action that should work, often only for
certain content.

<Callout type="warn">
  Disabling ModSecurity removes protection from **every** request to that domain,
  including the attacks it was blocking. It is a diagnostic step, not a solution.
  Where a specific rule is the problem, have that rule disabled instead — open a
  ticket with the details below and we can do that.
</Callout>

## Confirm it is actually ModSecurity [#confirm-it-is-actually-modsecurity]

Before disabling anything, check the logs. A 403 has other causes — file
permissions, `.htaccess` rules, a firewall block.

**cPanel → ModSecurity Tools** shows recent hits, with the rule ID and the
request that triggered it. If your action does not appear there, ModSecurity is
not the cause and disabling it will not help.

Note the **rule ID**. That is what lets us disable one rule rather than all of
them.

## Disable it for a domain [#disable-it-for-a-domain]

1. In cPanel, open **ModSecurity** under **Security**.
2. Find the domain.
3. Toggle it **Off**.

The change is immediate.

## Then re-enable it [#then-re-enable-it]

Once you have confirmed ModSecurity was the cause, turn it back on and open a
ticket with:

* The **rule ID** from ModSecurity Tools
* The URL and action that triggered it
* Roughly when it happened

A single disabled rule keeps the rest of the protection in place. Leaving the
whole firewall off on a site running WordPress or WooCommerce is a meaningful
risk, and one that tends to be forgotten about.

## If disabling changes nothing [#if-disabling-changes-nothing]

The 403 is coming from somewhere else:

* **`.htaccess`** — a `Deny` rule, or a country block. See
  [Block visitors by country](/en/security-ssl/how-do-i-block-particular-countries-from-visiting-my-websites).
* **File permissions** — see
  [File and directory permissions](/en/hosting/what-file-and-directory-permissions-should-i-use-for-my-web-files).
* **The firewall**, blocking your IP entirely — see
  [Unblock an IP address](/en/security-ssl/how-do-i-unblock-or-whitelist-an-ip-address-from-the-firewall).
* **A security plugin** in WordPress doing its own blocking.

## Related [#related]

* [Unblock an IP address from the firewall](/en/security-ssl/how-do-i-unblock-or-whitelist-an-ip-address-from-the-firewall)
* [Scan your site for malware](/en/security-ssl/malware-scanner-how-to-scan-your-sites-for-malware)