How to Protect Your Site with ModSecurity in cPanel

ModSecurity is a web application firewall (WAF) — think of it as a security guard that inspects requests to your website and blocks ones that look like attacks, such as hacking attempts and malicious bots. On VernalWeb it works quietly in the background, and you can manage it from cPanel.

What ModSecurity protects against

• Common attacks like SQL injection and cross-site scripting.
• Automated bots probing for vulnerabilities.
• Suspicious requests aimed at known weak spots in popular software.

Manage ModSecurity in cPanel

1. Log in to cPanel and open Security → ModSecurity.
2. You will see your domains with an On/Off switch for each.
3. Leave it On for the strongest protection (recommended).

Handling false positives

Occasionally ModSecurity blocks something legitimate — a plugin, a form submission, or a file upload. If a specific action suddenly returns a 403 Forbidden error right after you enabled it, ModSecurity may be the cause.

Rather than turning protection off entirely, it is far safer to have the specific rule adjusted. Note what you were doing when it happened and open a support ticket — we can whitelist that one rule and keep the rest of your protection intact.

Layer your security

ModSecurity is strongest alongside other measures: malware scanning with Imunify360, IP controls with CSF blacklisting, and keeping your software updated.

Frequently asked questions

Will ModSecurity slow my website down?

The impact is minimal for normal traffic, and the security benefit far outweighs it. Most visitors never notice it is there.

Should I ever turn ModSecurity off?

Only briefly, for troubleshooting, and ideally per domain. Leaving it off exposes your site — whitelisting a rule is the better fix.

I get a 403 error after enabling it.

A rule is likely blocking a legitimate action. Contact us with the details and we will fine-tune it instead of disabling protection.