Introduction
mod_evasive is an Apache security module used in cPanel servers to protect websites from HTTP DoS, DDoS, and brute-force attacks.
If mod_evasive is not tuned properly, it may block legitimate user traffic.
This guide explains how to tune mod_evasive on a cPanel server to balance security and usability.By default, mod_evasive logs are stored in:
/var/log/apache2/mod_evasive/
Prerequisites
Before proceeding, ensure you have:

1. Root or sudo access
2. SSH access to the server or Terminal access via WHM
3. Apache installed and running
4. mod_evasive already installed and enabled
   
   

Step 1:
Log in via SSH:

Or access Terminal directly from WHM.
Step 2:
Open the mod_evasive Configuration File
Edit the configuration file using your preferred editor.
Using vim

Using nano

Step 3:
Tune mod_evasive Settings (DDoS Related)
Adjust the following commonly used directives based on traffic:

Explanation:

DOSPageCount – Requests allowed for the same page
|DOSSiteCount – Total requests allowed to the site
DOSBlockingPeriod – Time (in seconds) an IP remains blocked
Increase values if legitimate users are being blocked.
Step 4:
Apply the changes by restarting Apache.

Monitor mod_evasive activity:

Conclusion
Properly tuning mod_evasive on a cPanel server helps mitigate DDoS attacks while allowing genuine traffic to pass through.
Always monitor logs after changes to ensure legitimate users are not impacted.