Disable ModSecurity

Turn off the web application firewall for a domain when it blocks legitimate requests — and why disabling the whole thing is the wrong first step.

Disable ModSecurity for a domain. Applies to shared, reseller and Premium hosting.

ModSecurity is a web application firewall that inspects requests and blocks those matching known attack patterns. It occasionally blocks legitimate ones — typically a page editor, a file upload, or a form containing something that resembles SQL.

The symptom is a 403 Forbidden on an action that should work, often only for certain content.

Disabling ModSecurity removes protection from every request to that domain, including the attacks it was blocking. It is a diagnostic step, not a solution. Where a specific rule is the problem, have that rule disabled instead — open a ticket with the details below and we can do that.

Confirm it is actually ModSecurity

Before disabling anything, check the logs. A 403 has other causes — file permissions, .htaccess rules, a firewall block.

cPanel → ModSecurity Tools shows recent hits, with the rule ID and the request that triggered it. If your action does not appear there, ModSecurity is not the cause and disabling it will not help.

Note the rule ID. That is what lets us disable one rule rather than all of them.

Disable it for a domain

In cPanel, open ModSecurity under Security.
Find the domain.
Toggle it Off.

The change is immediate.

Then re-enable it

Once you have confirmed ModSecurity was the cause, turn it back on and open a ticket with:

The rule ID from ModSecurity Tools
The URL and action that triggered it
Roughly when it happened

A single disabled rule keeps the rest of the protection in place. Leaving the whole firewall off on a site running WordPress or WooCommerce is a meaningful risk, and one that tends to be forgotten about.

If disabling changes nothing

The 403 is coming from somewhere else:

.htaccess — a Deny rule, or a country block. See Block visitors by country.
File permissions — see File and directory permissions.
The firewall, blocking your IP entirely — see Unblock an IP address.
A security plugin in WordPress doing its own blocking.