Applying a narrowly scoped ModSecurity exception as administrator

Confirm the exact rule ID, request and affected application from logs. Save current custom rules and determine the active ModSecurity engine, ruleset and supported exclusion mechanism. This is an administrator task, not a reason to give a customer unrestricted WHM access.

1. First check whether an application fix or vendor ruleset update resolves the false positive. Keep the reproducible test for comparison.
2. Design the smallest supported exclusion using the ruleset’s documentation, scoped to the necessary host, path or parameter. Record why the excluded input is legitimate.
3. Add the reviewed custom rule or supported per-domain include through the approved cPanel configuration mechanism. Do not edit managed vendor rule files that updates replace.
4. Validate configuration syntax and deploy through the supported workflow. WHM’s ModSecurity Tools can stage changes before its deploy-and-restart action.
5. Repeat the legitimate request and test that unrelated protected requests still receive the intended handling. Monitor logs and remove a temporary exception after the underlying fix.

The approved operation should work while the remaining ruleset stays enabled. Record the exception’s scope, author, date and review trigger so it does not become an unexplained permanent bypass.

If deployment fails, restore the saved custom configuration and validate before restarting again. If only a global disable control is available, ask the qualified server administrator for a narrower supported implementation rather than assuming the scope is per-domain.

Only after reviewing its exact match conditions and rule meaning. A copied broad exclusion can remove protection from inputs your application handles differently.

• Finding a ModSecurity rule ID for a blocked customer request
• Using supported Apache include configuration in WHM
• Downloading raw access logs for an incident investigation
• Planning key-based administrator access before disabling SSH passwords

• cPanel: Modsecurity Tools
• cPanel: Modify Apache Virtual Hosts With Include Files
• coreruleset.org: 2 3 False Positives And Tuning