Web Application Firewall

The Web Application Firewall (also known as ModSecurity or WAF) checks every request to your website for known attack patterns, such as attempts to insert code into a form. Suspicious requests are blocked before they reach your website. The firewall is switched on by default, and we recommend leaving it that way.

Sometimes the firewall blocks a request that was actually fine. You might then see an error 403 or 406 when saving a page, uploading a file or submitting a form. In that case, you can switch off a single rule for your domain.

The overview

In DirectAdmin, under Advanced Features, click Web Application Firewall. You'll see all the hostnames of the selected domain, with State showing whether the firewall is on (Enabled) and Exclusions showing how many rules you've switched off.

Which rule is blocking my request?

1. Try again whatever went wrong (for example, saving the page), so the request is blocked again.
2. In the overview, click Audit log (2). This shows the requests the firewall blocked, including the rule number (the rule ID).
3. You can also find the rule ID in your domain's error log (see Site summary & logs: the error log and the access log): look for ModSecurity and [id "..."].

Excluding a rule

1. Next to the hostname, click Modify (1).
2. Under Excluded rules, in Rule ID (2), enter the rule number. You can also enter a range, such as 1234-1239.
3. In Comment, enter why, for example "saving a page in WordPress". That way you'll remember later on.
4. Click Add exclusion, then click SAVE CONFIGURATION (3).

Then try again. If it works now, that was the rule. Use Undo changes to restore the settings to how they were.

Please note: Don't switch off the firewall completely (Disabled) just to get rid of a message. Only exclude the rule that's causing the problem. Every excluded rule makes your website slightly less protected, for the entire hostname.

Can't work it out?

Open a ticket with the address of the page, what you were doing and the time it happened. We'll then look up the rule for you. See also Error 403 or 406 when saving or uploading.