What is ModSecurity
ModSecurity in cPanel is a Web Application Firewall (WAF) that works at web server level and protects your website from malicious activity, such as SQL injections, XSS (Cross-Site Scripting), brute-force attacks and other application attacks.
It analyzes every request that reaches the server and compares it with known attack patterns. If it detects suspicious activity, it blocks the request before it reaches your application.
On Konet servers, ModSecurity is active on all accounts and is fully integrated with LiteSpeed Enterprise Web Server and Imunify360 for maximum security.
How ModSecurity works
ModSecurity is based on a set of security rules that cover hundreds of attack types.
Every time a visitor or bot sends a request to your website, ModSecurity checks it and decides whether it should be allowed or rejected.
For example, if a user tries to inject SQL commands into a form, ModSecurity will detect the pattern and prevent it from being executed.
How to check or temporarily disable ModSecurity
-
Log in to cPanel.
-
Go to the Security section and select ModSecurity.
-
You will see a list of your domains and their current status (Enabled or Disabled).
-
If you need to disable it temporarily for debugging, click Disable next to the domain.
-
You can enable it again at any time with one click.
Disabling it is not recommended unless there is a specific reason, such as testing an application or a confirmed false positive.
Benefits of ModSecurity on Konet servers
-
Active by default on all hosting plans.
-
Combined with Imunify360 for continuous security rule updates.
-
Fully compatible with LiteSpeed Enterprise Web Server.
-
Protects applications such as WordPress, Joomla, PrestaShop, Drupal and custom PHP scripts.
-
It can block attacks even before they affect the database or the site's files.
When ModSecurity may need to be temporarily disabled
There are rare cases where ModSecurity may block legitimate operations, especially if a plugin or script sends non-standard HTTP requests.
In that case:
-
Disable it temporarily from cPanel for the specific domain.
-
Check whether your operation completes normally.
-
Enable it again and, if the problem comes back, let Konet Support know so we can adjust the rule causing the problem.
Frequently Asked Questions (FAQ) about ModSecurity
Can I create my own ModSecurity rules?
No, this is done only by the server administrators. The rules are managed centrally by Konet.
How do I know if a request is being blocked?
If you see a 403 Forbidden message or a blank page when running an action, a ModSecurity rule may be responsible.
Does it affect the site's speed?
No, the checks run very quickly at web server level and do not cause delays.
Should I disable it during development?
Only if a script is being blocked. On most websites it can stay enabled without any problem.
Useful links
-
Official cPanel ModSecurity documentation: https://docs.cpanel.net/cpanel/security/modsecurity/
-
OWASP ModSecurity Core Rule Set: https://coreruleset.org/
-
Information about Imunify360 WAF: https://www.imunify360.com/features/
Conclusion
ModSecurity is one of the strongest layers of protection available in cPanel.
Combined with Imunify360 and LiteSpeed Web Server on Konet servers, it provides comprehensive defense against attacks and keeps websites secure without affecting performance.
Temporarily disabling it should only be done in special cases, while for anything related to false positives, Konet Technical Support can step in and adjust the rules accordingly.