Users are being blocked for mod_security violations and seeing Error 403

If users report seeing errors similar to the following, they may be triggering mod_security rules on the server:

Not Acceptable

An appropriate representation of the requested resource /dir/filename.php
could not be found on this server.

Forbidden

You must first determine which rule(s) are being triggered.

If you have ConfigServer ModSecurity Control installed (download it here), You can view the recent log entries to find the specific entry for this error. Look for the domain and date/time of the error
Look in the cPanel provided WHM > ModSecurity Tools
Look in /usr/local/apache/logs/error_log

Once you have the rule ID you can decide whether to disable it for the domain or the whole server:

With ConfigServer ModSecurity Control, you can then whitelist the rule for the server or for a specific domain or cPanel user.
You can also disable mod_security completely for a specific cPanel user or domain by selecting the account domain in the list and clicking Modify User whitelist. You then have the choice of disabling mod_security or adding rule IDs to the whitelist.
Use the tools in WHM > ModSecurity Tools and WHM > ModSecurity Vendor to disable the rule

Self-Hosted Help Desk Software by SupportPal

Categories