ModSecurity

Configure the web application firewall that helps protect websites from suspicious requests.

Where to find it: Open the Server menu and choose ModSecurity.

Available to: Root and resellers. A reseller sees only delegated accounts and provider-approved packages or features.

Before you start

Security settings can also block legitimate visitors. Start with a narrow rule or monitoring mode where available, then check that normal access still works.

Why use it — and when not to

Use ModSecurity to reduce a specific, evidenced risk. Avoid broad blocks, global disables, or permanent exceptions when a monitor mode or narrower rule can solve the same problem.

How to use it

1. Review the current protection mode and recent blocked requests.
2. Choose the intended rule settings or a narrow exception for a confirmed false positive.
3. Save and repeat the affected website request to check the result.

Global policy, domain profiles, and exclusions

Root can install/uninstall the module, enable global protection, choose Off/Detection Only/On, and manage global disabled rule IDs, tags, or advanced message exclusions. Per-domain controls have their own mode and application profile.

Choose a profile appropriate to the application and inspect the resulting exclusions. Prefer an evidenced domain-specific exception over a broad global disable. Detection Only is useful while checking legitimate traffic; switch to enforcement only after verifying the intended rules and requests. Resellers operate within their owned-domain scope.