Skip to main content

How to whitelist a specific URI in ModSecurity

cPRex
  • Updated

Question

How do you whitelist a specific URI in ModSecurity?
 
 

Answer

While working with ModSecurity, you may find it more convenient to whitelist a specific URI instead of allowing an IP address or disabling a rule completely.  You can do this by editing just one configuration file on the system.

In order to proceed, you should have the Rule ID and the URI that is triggering the ModSecurity rule. If you do not have them, you can find them in the Apache logs:

How do I check which ModSecurity rules are being triggered?

Once you have the required information, you can update the whitelist.

  1. Log in to the server via SSH or WHM's Terminal as the root user

  2. Edit the file /etc/apache2/conf.d/whitelist.conf with your preferred text editor. If the file does not already exist, you can create it:

    # touch /etc/apache2/conf.d/whitelist.conf

  3. Add the exclusion to the file. This is where you will place the path to be excluded and the rule ID:

    CONFIG_TEXT: <LocationMatch "/path/index.php">
    SecRuleRemoveById 20002221
    </LocationMatch>

  4. Ensure the whitelist is correctly configured:

    # apachectl -t

  5. If the check returns "OK," you can restart Apache:

    # /scripts/restartsrv_httpd

Related articles

Comments

0 comments

Article is closed for comments.

%