ModSecurity is an Apache web application firewall (WAF) that adds an extra layer of protection to your websites. It helps detect and block common attacks before they reach your applications.
About ModSecurity
-
Provides HTTP request filtering.
-
Protects against common exploits such as SQL injection, cross‑site scripting (XSS), and other malicious requests.
-
Enabled by default in cPanel for all domains.
Managing ModSecurity in cPanel
1. Accessing ModSecurity
-
Log in to cPanel.
-
On the Tools page → Security section, click ModSecurity.
2. Disabling ModSecurity
-
You may need to disable ModSecurity temporarily if an application does not function correctly with it enabled.
-
Options:
-
Disable for all domains → Under Configure All Domains, click Disable.
-
Disable for a specific domain → Under Configure Individual Domains, locate the domain and click Off.
-
3. Enabling ModSecurity
-
To re‑enable protection:
-
Enable for all domains → Under Configure All Domains, click Enable.
-
Enable for a specific domain → Under Configure Individual Domains, locate the domain and click On.
-
Important Notes
-
ModSecurity is enabled by default.
-
If your application breaks when ModSecurity is active, disable it temporarily and test.
-
For persistent issues, open a Support ticket, so we can investigate further.
-
More technical details are available on the ModSecurity GitHub wiki.
