How do I enable or disable ModSecurity (Modsec) through cPanel? Print

All shared, reseller, and semi-dedicated services have ModSecurity (Modsec) enabled by default. ModSecurity is a standard ruleset that enables an extra layer of security in front of your sites, keeping them safe from known exploits with software used in our environment. It is generally best practice to keep Modsec enabled.

A 403 error is a common symptom of triggering a Modsec rule. If you find your site hitting a 403 error you can contact our support team and ask we review our logs for the specific Modsec rule you're triggering. We will require you provide your personal IP (https://myip.hawkhost.com) to identify the Modsec rule(s) you're hitting. Once the Modsec rule ID is identified, that specific rule can be disabled through your .htaccess using the following syntax:

SecRuleRemoveById 12345

In the above example you'd replace "12345" with the rule ID identified through our logs by working with our support team.

If you wish to fully disable Modsec this can be done through the ModSecurity interface in cPanel:

1. Login to cPanel for your account and use the top-right search to look for the ModSecurity interface:
   
   
   
   
2. From the ModSecurity interface, locate the domain(s) you wish to disable Modsec. To the right of the domain is an On|Off toggle, switch the status accordingly:
   
   
   
   
3. Modsec will now be disabled and you should no longer see a 403 error on your site(s).