Users Getting Blocked Due To ModSecurity

[Vitya]

Hi. Some of our forum members are frequently getting blocked due to Modsecurity rules getting triggered (false-positive).

It seems to be happening with normal actions such as browsing a thread, submitting / editing a post, uploading attachments etc.

It does not happen each time, but it does happen often enough. Our webhost advised to disable certain rules, which I don’t want to.

We also tested with whitelisting certain URIs but it doesn’t seem to help much. I’m quite confused what to do.

Please suggest a suitable course of action that we can take without compromising our server or website security.

We’re not using Cloudflare at present. Do you think its free plan can help to avert this situation?

Thank you

 

[akok]

The action plan is simple:

1. Switch the WAF to detection-only mode.
2. Identify and exclude rules that cause false positives by reviewing the logs.

Depending on the ruleset (COMODO or OWASP), the latter has significantly more false positives.

Without excluding rules in ModSecurity, you won’t be able to solve the problem. Carefully check which rules are triggered — they might apply to outdated scripts unrelated to XenForo or the server software.