ContactSign in
← All documentationSearch guides

Investigate a ModSecurity block

Use request evidence and narrow exceptions instead of disabling the WAF globally.

  • Administrator
  • Intermediate
  • 1 min read
  • Reference: 101.18.15
  • Reviewed

Before you begin

Affected hostname, timestamp, path and sanitized response.

Use the controls offered by your installed version and account permissions. This guide describes the workflow; it does not grant additional access.

Follow the steps

  1. Distinguish application denial from a server/WAF rejection.
  2. Review the relevant event and rule ID.
  3. Reproduce a legitimate request safely and assess its rule match.
  4. Where justified, use a supported domain-specific exclusion with a recorded reason.
  5. Retest the legitimate request and unrelated protection.

Check the result

The request works with an exception limited to its actual false positive.

If something goes wrong

Not every 403 is ModSecurity: ownership, CSRF, authentication and application policy can also deny requests.

Prepare useful details for support