ModSecurity is server software for Apache that comes bundled with cPanel. ModSecurity helps protect your site from brute force attacks and, by default, automatically runs on all accounts. ModSecurity should usually remain on. In certain situations, such as a WordPress admin lockdown caused by brute force attacks, you may need to temporarily deactivate ModSecurity to resolve an issue. The below steps show how to disable ModSecurity in cPanel.

This applies to the latest versions of cPanel (starting in cPanel version 82).

While certain versions of ModSecurity used to allow admins to whitelist specific IP addresses, this feature is no longer supported due to security and performance concerns.

Disable ModSecurity for Individual Domains

  1. Log into cPanel.
    cPanel Login
  2. Choose ModSecurity listed under Security.
    Accessing ModSecurity
  3. Select the domain you are working with and switch ModSecurity from On to Off.
    ModSecurity Switch
  4. Wait for the pop-up telling you that ModSecurity has been disabled.
  5. Troubleshoot the issue that you are having.
  6. Return to cPanel and reactivate ModSecurity immediately after solving the issue you are experiencing. If you stop troubleshooting and need to wait before continuing, be sure to reactivate ModSecurity. Do not leave ModSecurity disabled any longer than necessary.
    modSecWarning


Well done! You now know how to disable ModSecurity through cPanel.

ModSecurity is ready to go when you start with one of our Hosting Plans!

Did you find this article helpful?

We value your feedback!

Why was this article not helpful? (Check all that apply)
The article is too difficult or too technical to follow.
There is a step or detail missing from the instructions.
The information is incorrect or out-of-date.
It does not resolve the question/problem I have.
How did you find this article?
Please tell us how we can improve this article:
Email Address
Name

new! - Enter your name and email address above and we will post your feedback in the comments on this page!

Did you find this article helpful?

Comments

n/a Points
2014-04-14 10:00 am

disabled modsec but still get 406 error

Staff
2,342 Points
2014-04-14 5:18 pm
If you have disabled mod_security and are still getting a 406 error with it still turned off, you may want to contact technical support with details on how to replicate the issue to further investigate.
n/a Points
2014-07-09 8:25 am
the article would be correct however mod_security can't be disabled on my site. I keep getting an 'Error disabling mod_security" error
Staff
3,713 Points
2014-07-09 8:34 am
Hello Jami,

If you are having issues with a ModSecurity rule, and running into issues disabling it. Please be sure to submit a verified ticket explaining the issue you're having so that our system administration team can review that is going wrong that it won't let you disable it.

- Jacob
n/a Points
2014-09-12 6:33 am

My website is now completly down after I did this :

"WordPress admin access via restricted IP" 

and then changed

Temporarily disable ModSecurity on your account.

What do I do ? I cant get to the admin or even view the website?

Staff
16,266 Points
2014-09-12 3:43 pm
Hello Katie,

I checked your site and it seems to be working correctly. I looked in the logs for the ModSecurity errors and saw that the server was having an issue with the images coming from photobucket. The way they come across looks like a possible attack to the server. The other error I saw was just the normal 15 min block occasionally placed due to attempts to log in and failing too many times.

Kindest Regards,
Scott M

Post a Comment

Name:
Email Address:
Phone Number:
Comment:
Submit

Please note: Your name and comment will be displayed, but we will not show your email address.

Related Questions

Here are a few questions related to this article that our customers have asked:
Ooops! It looks like there are no questions about this page.
Would you like to ask a question about this page? If so, click the button below!
Need More Help?

Help Center Search

Current Customers

Email: support@WebHostingHub.com Ticket: Submit a Support Ticket
Call: 877-595-4HUB (4482)
757-416-6627 (Intl.)
Chat: Click To Chat Now

Ask the Community

Get help with your questions from our community of like-minded hosting users and Web Hosting Hub Staff.

Not a Customer?

Get web hosting from a company that is here to help.
}