Disable ModSecurity in DirectAdmin becomes simple if we disable Apache from loading the ModSecurity module in the ModSecurity configuration file.

Bobcares, as a part of our Server Management service, responds to all inquiries, large or small.

Let’s take a closer look at disable ModSecurity in DirectAdmin.

Disable ModSecurity in DirectAdmin

One of the most crucial and difficult topic ever is maintaining the security of the websites. To serve this purpose, ModSecurity is a reliable option. Basically, it is an Apache extension particularly developed to save the website from harmful activities.

It is a web application that makes the server’s firewall available. With the ModSec toolkit, administrators can use tasks like real-time web application monitoring, comprehensive traffic logging, etc. They also have full access control over the rules that protect the server. So, it may be able to prevent common code injection attacks, thereby enhancing server security.

Occasionally, there is a need to disable mod_security on server. For instance, in order to fix a brute force attack-induced WordPress admin lockdown, we may need to disable it temporarily. Here we can see the steps to disable ModSecurity on DirectAdmin server.

In the Default custom-build installation, mod_security rules will be in:

• /etc/modsecurity.d/

ModSecurity modules and configuration will be in:

• /etc/httpd/conf/extra/httpd-modsecurity.conf

Disabling mod_security: Various methods

• Method 1:

  Disabling ModSecurity module Using httpd-modsecurity.conf-: Disabling Apache from loading the ModSecurity module in the https-modsecurity.conf file is the simplest way to disable ModSecurity. To begin, simply add #comments to the LoadModule directive.

  

• Method 2:

  Disabling ModSecurity module Using SecRuleEngine-: Alternately, we can change SecRuleEngine to Off if we want to keep the ModSecurity module loaded into Apache.

  SecRuleEngine Off

• Method 3:

  Disabling ModSecurity rules With DirectAdmin-: The following steps will help to disable/enable modsecurity rules with DirectAdmin.

  1. Firstly, open the dashboard on DirectAdmin.
  2. Then, click on the ModSecurity icon from the Advanced Features section.
  3. Now open the Status & Disabled Rules tab.
  4. Then, to enable or disable the ModSecurity tool, select the On or Off radio button for SecRuleEngine, then click the SAVE button.
  5. Finally, a message stating “ModSecurity Rules Saved” will be produced by the system.

• Method 4:

  Disabling ModSecurity Rule ID With DirectAdmin-: When it comes to software security, ModSecurity is extremely sensitive, to the point where a rule could result in a false-positive. Such problems frequently arise in some Content Management Systems (CMS), such as WordPress. We can disable such a ModSecurity Rule ID as opposed to turning off the tool application altogether. We can search for and disable a specific Rule ID in the section titled Disabled Rules.

  1. Firstly, in the ID field of the Disabled Rules section, enter the rule ID. Then, click the DISABLE RULE button after that.
  2. Then, there will be a success message at the bottom of the screen: The system will add the Rule ID to the list under the ModSecurity Disabled Rules section after adding the skipped rule.
  3. Then, select the checkbox next to the Rule ID and click the Delete button to re-enable the disabled ModSecurity Rule.
  4. Finally, at the bottom of the screen, the system will flash a message that reads, “Selected skipped rules removed.” Additionally, the Rule ID will be removed from the section listing ModSecurity Disabled Rules.

  [Looking for a solution to another query? We are just a click away.]

  Conclusion

  To sum up, ModSecurity is a dependable option for maintaining website security. We may need to disable ModSecurity from time to time. We explained in this article how our Support team disabled ModSecurity in DirectAdmin.

  PREVENT YOUR SERVER FROM CRASHING!

  Never again lose customers to poor server speed! Let us help you.

  Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

  GET STARTED