ModSecurity is a security filter built into your hosting account that blocks requests which look malicious before they reach your website. Most of the time it runs quietly in the background, but sometimes you'll need to turn it off for a specific domain, usually to test whether it's the cause of an error your site is showing, then turn it back on once you've finished troubleshooting.
You can control ModSecurity per domain from your control panel. The steps differ slightly depending on whether your hosting account uses cPanel or DirectAdmin.
How to Turn ModSecurity On or Off
In cPanel
- Log in to your cPanel account.
- Under the Security section, click ModSecurity.
- You'll see a list of your domains with a toggle switch next to each one. Find the domain you want to change.
- Click the toggle to switch ModSecurity On or Off for that domain.
The change takes effect immediately. There's no need to wait or restart anything.
In DirectAdmin
- Log in to your DirectAdmin account.
- Go to Extra Features and click ModSecurity (on some accounts this appears as part of the domain setup page).
- Select the domain you want to change from the list.
- Use the Enable or Disable option to switch ModSecurity for that domain.
If you don't see a ModSecurity option in DirectAdmin, it may be managed at the server level instead. Contact ZIPROF support and we'll check it for you.
What to Check Before You Disable It
Turning ModSecurity off removes a layer of protection from your website, so it's worth ruling out other causes first.
- If you're only seeing a single blocked action, such as a contact form submission or a login, one specific rule may be causing the problem rather than ModSecurity as a whole.
- Disabling ModSecurity should usually be temporary, for example while you confirm it's the source of an error, not a permanent setting.
- If you turn it off to finish a task, remember to turn it back on afterward.
If your website is showing a 403 Forbidden error that you suspect ModSecurity is causing, see How to Fix a 403 Forbidden Error Caused by ModSecurity for how to find and work around the specific rule instead of disabling protection for the whole domain.