How to Fix a 403 Forbidden Error Caused by ModSecurity

A 403 Forbidden error that appears only on certain pages, like a contact form, login page, or after a file upload, is often caused by ModSecurity, a firewall built into your hosting server. It scans incoming requests for patterns that look like attacks and blocks them automatically, but it sometimes flags legitimate activity too, like an unusual password, a long comment, or a plugin doing something out of the ordinary. The fix is to find the exact rule that blocked you and turn off just that rule, not ModSecurity as a whole.

What ModSecurity Does

ModSecurity checks every request against a set of rules and blocks anything that matches a suspicious pattern. Each rule has a unique ID number. When it blocks something, that ID is recorded in a log you can look up, which tells you exactly what was flagged.

Step 1: Find the Rule ID That Blocked You

Before you can disable anything, you need the rule ID. Reproduce the action that triggered the 403 error, such as submitting the form again, then check the log right after.

In cPanel

1. Log in to cPanel.
2. Under the Security section, click ModSecurity.
3. Click Audit Log next to your domain.
4. Find the most recent entry matching the time you got the error, and note the ID value shown next to it.

In DirectAdmin

1. Log in to DirectAdmin.
2. Go to Extra Features and click ModSecurity Log (or look under Advanced Features, depending on your server's menu layout).
3. Look for the entry that matches the time of the error and note the rule ID listed in it.

If you can't find a matching entry, the 403 may not be caused by ModSecurity at all. It could instead be a file permissions issue or an .htaccess rule, so check those before continuing.

Step 2: Disable That Specific Rule

Once you have the rule ID, disable only that rule for the affected domain. Leave every other rule active so the rest of your site stays protected.

In cPanel

1. Go back to ModSecurity under the Security section.
2. Find your domain in the list and click Edit Rules (or the toggle icon next to the domain).
3. Locate the rule matching the ID you noted and click to Disable it for that domain.
4. Save your changes and repeat the action that previously triggered the error to confirm it now works.

In DirectAdmin

1. Go to the ModSecurity management page in your DirectAdmin panel. The exact path depends on your server's configuration, so ask your host if you don't see it under Extra Features.
2. Search for the rule ID you noted.
3. Set that specific rule to Off or Disabled for your domain.
4. Save, then repeat the original action to confirm the 403 error is gone.

Never disable ModSecurity entirely for your account just to fix one error. Turning off a single rule keeps you protected from everything else it checks for.

If You Don't Have Access to Disable Rules Yourself

Some hosting plans manage ModSecurity at the server level rather than the account level, so the option may not appear in your control panel. If that's the case, contact your host's support with the rule ID and the page where the block happened, so it can be whitelisted for your account.

For other common error codes and what causes them, see Common Website Errors Explained (404, 500, 403) and How to Fix Them.