ModSecurity - Your shield against cyber attacks

ModSecurity - Your shield against cyber attacks

What is ModSecurity?

ModSecurity is what is known as a web application firewall - or WAF for short. Think of this technology as a highly skilled bouncer for your website: every request a visitor makes to your site is first checked by ModSecurity before it reaches your website.

This check is carried out using a comprehensive set of rules that is continuously updated and recognises known attack patterns. These include, amongst others:

• SQL injection: In this type of attack, attackers attempt to inject malicious database commands via input fields. The aim is to steal sensitive data such as customer addresses, passwords or payment details.
• Cross-site scripting (XSS): This involves attempts to embed malicious code into your website, which is then executed in your visitors’ browsers - for example, to intercept login details.
• Path traversal: Attackers attempt to access files that should not be publicly accessible, such as configuration files containing database credentials.
• Remote Code Execution: The most dangerous form of attack, in which attackers attempt to execute their own code on your server and thereby take complete control.

Why is ModSecurity important?

Cyberattacks on websites are no longer a rarity. Automated programmes scan the internet round the clock for vulnerable websites - regardless of whether it is a small blog or a large online shop. Content management systems such as WordPress, Joomla or Drupal are particularly popular targets due to their widespread use.

ModSecurity protects your website at server level, even before an attack can reach your application. This protection is particularly valuable when security updates for plugins or themes are not yet available.

When legitimate requests are blocked

As powerful as ModSecurity is, in rare cases so-called ‘false positives’ can occur. This means that a completely harmless request is mistakenly classified as a threat and blocked.

This typically happens when legitimate content happens to contain patterns that are also used in attacks. For example, a blog post about databases might contain passages of text that look like SQL commands.

Typical signs of a block

You can recognise a ModSecurity block by the following symptoms:

• Error message 403 Forbidden: Your browser displays this message when access has been denied.
• Functional failures: Certain parts of your website do not work - such as saving posts, uploading files or using certain plugins.
• Incomplete display: Pages load only partially or certain elements are missing.
• Form issues: Contact forms do not submit or display error messages.

How to analyse the problem

Step 1: Access the error log

Every block is logged in your domain’s error log. You can find this file in the following location (via FTP, SSH or in the file manager):

/home/users/BENUTZERNAME/logs/ihre-domain.de/error.log

Step 2: Identify ModSecurity entries

Look for entries that [security2:error] or ModSecurity . A typical entry looks like this:

[Fri Dec 19 22:26:15 2025] [security2:error] ModSecurity: Warning.
[id "9522200"]
[msg "Wordpress hardening: attempt to access php files other than index.php"]
[hostname "ihre-domain.de"]
[uri "/wp-includes/example.php"]
[unique_id "aUXC9_pHoET509mQzQODMwAAAFQ"]

Step 3: Understanding the key information

Each log entry contains key information that is essential for analysis:

The Rule ID and Unique ID are particularly important: they enable our support team to identify and analyse the incident precisely.

Our support team is here to help

If you suspect a false positive, please create a support ticket with the following details:

1. Affected domain: On which website is the problem occurring?
2. Description of the problem: What is not working as expected?
3. Rule ID and Unique ID: These details from the error log
4. Time: When did you notice the problem?
5. Reproducibility: Does the error occur every time you try?

Example of a support enquiry

Subject: ModSecurity block on my-domain.de

Hello,

Since this morning, I have been unable to upload images in WordPress. The upload process aborts with an error message.

• Domain: my-domain.de
• Rule ID: 200004
• Unique ID: xYz123AbC...
• Time: 19 December 2025, around 10.30 am
• Reproducible: Yes, every time I try to upload

Please check whether an exception rule can be created.

What happens after you submit your request?

Our security team carries out a thorough analysis:

1. Legitimacy check: We investigate whether the blocked request was actually harmless or whether it was a genuine attempted attack.
2. Context analysis: We check whether the problem is related to known plugins, themes or applications.
3. Targeted solution: In the case of confirmed false positives, we create a precise exception rule that only allows the legitimate function to proceed, without compromising overall security.

Common scenarios and their causes

First steps for self-help

Before contacting support, you can try the following steps:

• Clear your browser cache: Data stored in your browser can cause malfunctions. Clear the cache and reload the page.
• Rule out a plugin conflict: Temporarily deactivate all plugins except the one affected to rule out any interactions.
• Switch themes: Activate a default theme on a trial basis to check whether the problem is theme-related.
• Try again at a different time: Occasionally, temporary network issues are the cause of connection errors.

Our security commitment

ModSecurity is an essential part of our security strategy. Although occasional false positives may occur, the protection against genuine threats far outweighs them. Every day, thousands of attempted attacks are blocked before they can cause any damage.

We are constantly working to optimise the rule set and minimise false positives - without compromising on security.