Add the below rule in the .htaccess file.

SecRuleEngine Off

This will work only if you have old version of mod_security installed on
the server. You cannot disable mod_security2 using .htaccess, the only way
to bypass mod_security2 in Apache 2 is to manually edit httpd.conf. Create
a directory with the username and the domain name, then create a
mod_security.conf file, add the modsecurity rule in the file.

# mkdir -p /usr/local/apache/conf/userdata/std/2/username/domain.com

# vi /usr/local/apache/conf/userdata/std/2/username/domain.com/mod_security.conf

SecRuleEngine Off
  1. Beyond WAF: Why Apache WAAP is the Must-Have Security Control for 2026

    April 8, 2026

    […] by searching the audit logs for specific rule IDs that triggered the block. Use the command grep "ModSecurity: Access denied" /var/log/apache2/error.log to find these entries. Once the problematic rule is […]

Post a comment

Your email address will not be published.

Related Posts