Adjusting ModSecurity Rules in DirectAdmin
In this article you'll learn how to:
ModSecurity is a security module for web servers that automatically blocks suspicious HTTP requests. This protects your website against attacks, but can sometimes also block legitimate requests (so-called 'false positives'). This then leads to a 403 Forbidden error message when you or your visitors try to access certain pages.
In this article you'll learn how to:
- Identify which ModSecurity rule is causing a block
- Disable specific rules per domain
- Completely deactivate ModSecurity for a domain (if necessary)
What do you need?
- Access to the web panel as a user of the relevant domain
- DirectAdmin access at VPS level
- Basic knowledge of reading log files
Step 1: Identify the blocked rule
Before you can adjust a rule, you first need to know which rule is causing the block.
1.1 Open the error logs
- Log in to the web panel with the credentials of the relevant domain
- Navigate to System Info & Files
- Click on Site Summary / Statistics / Logs
- Open the Error Log
1.2 Search for the ModSecurity notification
Scroll through the log file and look for lines that start with ModSecurity: Access denied. A typical error message looks like this:
[Fri Nov 20 17:00:50.493215 2020] [:error] [pid 20195:tid 140060137608960]
[client 1.2.3.4:50882] ModSecurity: Access denied with code 403 (phase 2).
Match of "rx ^(\\d*|uploads\\/.*\\.(jpeg|jpg|gif|png|bmp))$" against "ARGS_GET:img" required.
[file "/usr/local/cwaf/rules/29_Apps_WPPlugin.conf"] [line "624"] [id "222050"]
[rev "4"] [msg "COMODO WAF: Directory traversal vulnerability..."]
[severity "CRITICAL"] [hostname "www.example.com"] [uri "/wp-admin/admin-ajax.php"]
1.3 Note the rule ID
The most important part is the rule ID, in the above example: [id "222050"]
Note this number – you'll need it in the next step.
Step 2: Disable the rule
Now that you know which rule is causing the block, you can specifically disable it for the relevant domain.
- In DirectAdmin, go to Account Manager (hover your mouse over the menu item)
- Click on Domain Setup
- Select the domain for which you want to disable the rule
- Click on the ModSecurity button (at the bottom or top right in the domain settings)
- Enter the rule ID you found in step 1 (for example
222050) - Click on Disable Rule
The rule is now disabled for this specific domain. Other domains on the same server will still be protected by this rule.
Completely disabling ModSecurity (not recommended)
If you're experiencing many problems with ModSecurity and want to temporarily disable all security checks for a domain, you can do this as follows:
- Follow the same steps as above up to the ModSecurity screen
- Find the SecRuleEngine setting
- Set this to Off
- Save the change
⚠️ Warning: This disables all ModSecurity protection for the domain. Only use this temporarily for testing, not as a permanent solution.
Common problems
I don't see any ModSecurity notifications in my error log
- Check if you're looking at the correct date/time when the block occurred
- Some blocks may also be in other log files; try viewing the Apache Error Log as well
- If the logs are empty, ModSecurity may not be active for this domain
The error message persists after disabling the rule
- Clear your browser cache and try again
- Check if you've selected the correct domain
- It may take a few seconds before the change becomes active – reload the page after 30 seconds
Which rules can I safely disable?
This depends heavily on your situation. General guidelines:
- Only disable rules that you're certain are causing a false positive
- Document which rules you disable and why
- Consider fixing the underlying cause instead of disabling the rule (for example: update your WordPress plugins if the rule detects a known vulnerability)
Related information
Need help? Contact us via support.etheron.nl