Disable ModSecurity Rule in CWP

This article will assist in disabling ModSecurity Rules in Control Web Panel (CWP).

ModSecurity, also known as ModSec, is a web server module that works as a Web-based Application Firewall (WAF) to filter out malicious requests based on rule sets.

However, it can sometimes block legitimate requests, resulting in a 403 or 406 error when trying to complete a specific action or access a web page. While disabling ModSecurity will prevent these errors, it is not recommended to do so.

Instead, the preferred solution is to disable the specific ModSecurity rule causing the issue. Here, we cover the steps to determine and disable a ModSecurity rule inhibiting website functionality on your VPS or Dedicated server.

Related Articles

Check Apache Error Log

Disable Domain ModSec Rules

IMPORTANT: This solution will require root access. If this needs to be obtained, follow the guide on requesting root access.

1. Log into CWP Admin
2. Click on Security to open the drop-down menu
3. Click Mod Security
   
   
4. Select the Logs tab and review the logs for a line similar to this
   

   [Tue Nov 14 02:39:46.114084 2023] [:error] [pid 1093:tid 140034363574016] 
        [client 193.233.233.120:54792] [client 193.233.233.120] ModSecurity: 
        Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. 
        [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] 
        [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] 
        [tag "Generic"] [hostname "domain.com"] 
        [uri "/domain.com/.env"] 
        [unique_id "ZVMkQp90EWuKbVGQcfyL-gAAANA"]

   TIP: The search can be narrowed down by entering an IP address and selecting a domain from the drop-down list.
   
   
5. Locate the ID
   EXAMPLE: The information we are looking for will be similar to [id "13052"].  In this example, 13052 would be the ID.
6. Select the Domains tab
7. Click on Edit rules
   
   
8. Under Add Id Rules, enter the rule ID
9. Click Add
   
10. Navigate to the Dashboard from the menu
11. Locate the Services Status section
12. Click the orange Restart button on the Apache Webserver row