Add the below rule in the .htaccess file. SecRuleEngine Off This will work only if you have old version of mod_security installed on the server. You cannot disable mod_security2 using .htaccess, the only way to bypass mod_security2 in Apache 2 is to manually edit httpd.conf. Create a directory with the username and the domain name, then create a mod_security.conf file, add the modsecurity rule in the file. # mkdir -p /usr/local/apache/conf/userdata/std/2/username/domain.com # vi /usr/local/apache/conf/userdata/std/2/username/domain.com/mod_security.conf SecRuleEngine Off
-
Previous Post
Mysql Queries in Linux
-
Next Post
OpenVZ Installation On CentOS 5
Beyond WAF: Why Apache WAAP is the Must-Have Security Control for 2026
April 8, 2026[…] by searching the audit logs for specific rule IDs that triggered the block. Use the command grep "ModSecurity: Access denied" /var/log/apache2/error.log to find these entries. Once the problematic rule is […]
How to Fix ModSecurity Issues in cPanel? | actsupport
July 21, 2026[…] ModSecurity Issues in cPanel occur when the Web Application Firewall (WAF) incorrectly identifies legitimate HTTP requests as malicious and blocks them before they reach the web application. ModSecurity is integrated into most cPanel hosting environments to inspect inbound HTTP and HTTPS traffic against a large collection of security rules based on the OWASP Core Rule Set (CRS) and custom vendor policies. Every request sent by a browser is analyzed at multiple processing phases, including request headers, URI parameters, cookies, POST payloads, multipart uploads, and response bodies. If a request matches predefined attack signatures such as SQL Injection, Cross-Site Scripting (XSS), Local File Inclusion (LFI), Remote Code Execution (RCE), or Command Injection patterns, ModSecurity immediately interrupts the request and returns an HTTP response such as 403 Forbidden, 406 Not Acceptable, or sometimes 500 Internal Server Error depending on the configured action. Although this behavior dramatically reduces the attack surface of a hosting server, false positives remain one of the most common operational challenges because modern CMS platforms, page builders, AJAX applications, REST APIs, and custom PHP applications often generate requests that resemble attack payloads even when they are completely legitimate. […]