Mod_security is an apache module that helps to protect your website from various attacks. Mod_Security is used to block commonly known exploits by use of regular expressions and rule sets. Mod_Security is enabled on all etandyServers by default. Mod_Security can potentially block common code injection attacks which strengthens the security of the server. If you need to disable mod_security we can show you how, and help you do so.
When coding a dynamic website, sometimes users forget to write code to help prevent hacks by doing things such as validating input. Mod_security can help in some cases those users that run sites that don’t have security checks in their code.
This is a simple SQL injection where visiting this would cause the database to DROP and delete the users table from the database. If you are running Mod_Security on your server it will block this from running. Typically, you would see a 406 error in this case if mod_security is enabled. To read more about 406 errors read our article. You set up rules for Mod_security to check http requests against and determine if a threat is present.
Recognizing Mod_Security is pretty easy. Any website that calls a string forbidden by a mod_security rule will give a 406 error instead of displaying the page. You can also disable mod_security using the tool “set_modsec” for a single domain or entire hosting account. If you’re on a shared server and wish to disable Mod_Security contact our support department and we can take care of it for you. Customers on shared servers do not have access to this tool as it is ran from the command line and this feature is not available on shared servers.