Server Configuration Issues with ModSecurity

Shaijee

I am encountering some issues with the ModSecurity. When I enable ModSecurity, I face difficulties accessing the /wp-admin/site-health.php page, resulting in a "Forbidden" error message indicating a lack of permission to access the resource.

Additionally, I am having trouble saving or updating any pages on my website. Whenever I attempt to save changes, I encounter an error stating "Updating failed. The response is not a valid JSON response."

Moreover, Elementor Page Builder is also affected by a similar problem, showing an "Error 403" message.

I kindly request the Enhance team to look into these issues and provide a solution to resolve them promptly.

Thank you in advance for your assistance and support in addressing these concerns. Your help is greatly appreciated.

twest

Shaijee search the forum, I posted many of the exclusions you need to add to restore various functionality within WP. In my experience, it was a never ending job of excluding things over and over and over. Eventually I gave up because it seemed like I would just keep stripping ModSec down until there's nothing left, easier to just toss the whole thing out... Seriously think I had 60% of ModSec disabled, and still had conflicts to resolve. Not worth it.

xyzulu

See: https://enhance.com/docs/security/modsecurity
You will need to whitelist many rules/blocks if you use ModSecurity and Wordpress (in my experience)

mah1952

twest Same here. They need to implement Comodo WAF rules (with auto updates) instead of the stupid OWASP. The Comodo rules is working good on CWP with no issues.

DracoBlue

As mentioned by colleagues above, it requires adding numerous rules to mod_security for it to work properly, and this is not only the case in the Enhance panel but also in other panels. I have it disabled on my end.

slimx

DracoBlue Disabled here too - way too buggy

Shaijee

It has no firewall management, no other security tools, just ModSecurity, which is buggy. At least, Enhance should officially integrate a security system/tools.

Adam

mah1952

You can easily add other rule sets to /etc/modsecurity.d and load them in the mod security config manager.

We will be offering other options for automatic deployment of 3rd party rule sets in the future.

mah1952

Adam

I tried this with no success. I hope you make this change asap , It's an easy fix, and it will make Enhance newcomers and testers feel much better that their new panel can actually work out of the box. When I was first testing Enhance, I was very frustrated by this ModSecurity issue, which killed lots of functionalities on my sites (and even brought some of them totally down!). I was about to give up and stop testing Enhance until I found out it's the stupid ModSecurity module that needs to be closed to fix all the issues. I'm pretty sure Enhance lost lots of clients because of this. I'm very happy with Enhance, but lots of testers will feel like it's a broken panel and just leave!

inspiredearth

Is ModSecurity enabled by default?
If it is, how do I disable it? Nothing comes up when I search for “ModSecurity” in the Enhance control panel.

UPDATE: Okay, so I’ve now found this ... https://enhance.com/docs/security/modsecurity.html ... which I gather will answer my question.