{"id":134,"date":"2011-11-27T07:41:00","date_gmt":"2011-11-27T07:41:00","guid":{"rendered":"http:\/\/pheonixsolutions.com\/?p=134"},"modified":"2026-05-10T09:31:26","modified_gmt":"2026-05-10T04:01:26","slug":"mod_security-disable-how-to-disable-mod_security-for-a-user","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/mod_security-disable-how-to-disable-mod_security-for-a-user\/","title":{"rendered":"How to Disable ModSecurity for a User or Domain in cPanel\/WHM"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Introduction<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">ModSecurity is an Apache web application firewall (WAF) module that helps protect websites from common attacks such as SQL injection, cross-site scripting (XSS), and malicious POST requests. While it provides an additional layer of security, certain applications or websites may generate false positives, resulting in errors such as <strong>406 Not Acceptable<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In such cases, ModSecurity can be temporarily disabled either through the <code>.htaccess<\/code> file or by creating a custom Apache configuration for a specific domain.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before proceeding, ensure the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Root or sudo access to the server<\/li>\n\n\n\n<li>WHM\/cPanel server with Apache installed<\/li>\n\n\n\n<li>ModSecurity module enabled on the server<\/li>\n\n\n\n<li>Basic knowledge of Linux command line operations<\/li>\n\n\n\n<li>Backup of existing Apache configuration files<\/li>\n\n\n\n<li>Ensure disabling ModSecurity is necessary, as it reduces website protection<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Method 1: Disable ModSecurity Using <code>.htaccess<\/code><\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">This method disables ModSecurity for a specific website using the site&#8217;s <code>.htaccess<\/code> file.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Open the <code>.htaccess<\/code> File<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Navigate to the website document root and edit the <code>.htaccess<\/code> file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">cd \/home\/USERNAME\/public_html\nvi .htaccess\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Add the Following Lines<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Insert the following directives into the <code>.htaccess<\/code> file:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">SecFilterEngine Off\nSecFilterScanPOST Off\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Save the File<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Save the changes and exit the editor.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Test the Website<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Access the website and verify whether the issue has been resolved.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Note: In newer ModSecurity versions, these directives may not work because they are deprecated.<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Method 2: Disable ModSecurity for a Specific Domain Using Apache Configuration<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">If the <code>.htaccess<\/code> method does not work, create a custom Apache configuration for the domain.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Verify Apache Include Paths<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Check the Apache configuration includes:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">Include \"\/usr\/local\/apache\/conf\/userdata\/*.conf\"\nInclude \"\/usr\/local\/apache\/conf\/userdata\/*.owner-root\"\nInclude \"\/usr\/local\/apache\/conf\/userdata\/std\/*.conf\"\nInclude \"\/usr\/local\/apache\/conf\/userdata\/std\/*.owner-root\"\nInclude \"\/usr\/local\/apache\/conf\/userdata\/std\/2\/*.conf\"\nInclude \"\/usr\/local\/apache\/conf\/userdata\/std\/2\/*.owner-root\"\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">These paths allow custom domain-specific Apache configurations.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Navigate to the Userdata Directory<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">cd \/usr\/local\/apache\/conf\/userdata\/std\/2\/\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Create User and Domain Directories<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Domain: <code>google.com<\/code><\/li>\n\n\n\n<li>cPanel Username: <code>goog<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Create the directories:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">mkdir goog\ncd goog\nmkdir google.com\ncd google.com\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 4: Create the ModSecurity Configuration File<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">touch mod_security2.conf\nvi mod_security2.conf\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Add the following line:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">SecRuleEngine Off\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Save and exit the file.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 5: Rebuild Apache Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Run the following command:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/scripts\/ensure_vhost_includes --all-users\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Step 6: Restart Apache<\/h2>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">\/etc\/init.d\/httpd restart\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Or on newer systems:<\/p>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">systemctl restart httpd\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Verification<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">After restarting Apache:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Open the website in a browser<\/li>\n\n\n\n<li>Verify the previous ModSecurity-related errors are resolved<\/li>\n\n\n\n<li>Review Apache logs if needed:<\/li>\n<\/ul>\n\n\n\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\" data-enlighter-theme=\"\" data-enlighter-highlight=\"\" data-enlighter-linenumbers=\"\" data-enlighter-lineoffset=\"\" data-enlighter-title=\"\" data-enlighter-group=\"\">tail -f \/usr\/local\/apache\/logs\/error_log\n<\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Disabling ModSecurity for a specific user or domain can help resolve issues caused by false-positive security rules. Using a domain-specific Apache configuration is the preferred method because it avoids disabling protection server-wide. However, ModSecurity should only be disabled when necessary, and alternative rule exclusions should be considered whenever possible to maintain server security.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Introduction ModSecurity is an Apache web application firewall (WAF) module that helps protect websites from common attacks such as SQL [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1019],"tags":[],"class_list":["post-134","post","type-post","status-publish","format-standard","hentry","category-cloud-aws","psol-cat-cloud-aws"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-2a","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/134","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=134"}],"version-history":[{"count":1,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/134\/revisions"}],"predecessor-version":[{"id":10168,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/134\/revisions\/10168"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=134"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=134"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=134"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}