How can I disable mod_security in .htaccess file?

Question

How can we disable mod_security by using .htaccess file on Apache server?

I am using WordPress on my personal domain and posting a post which content has some code block and as per my hosting provider said mod_security gives an error and my IP has gone into firewall because of mod_security.

So I want to disable mod_security by using .htaccess file.

Answer 1

It is possible to do this, but most likely your host implemented mod_security for a reason. Be sure they approve of you disabling it for your own site.

That said, this should do it;

<IfModule mod_security.c>   SecFilterEngine Off   SecFilterScanPOST Off </IfModule> 

Answer 2

On some servers and web hosts, it's possible to disable ModSecurity via .htaccess, but be aware that you can only switch it on or off, you can't disable individual rules.

But a good practice that still keeps your site secure is to disable it only on specific URLs, rather than your entire site. You can specify which URLs to match via the regex in the <If> statement below...

### DISABLE mod_security firewall ### Some rules are currently too strict and are blocking legitimate users ### We only disable it for URLs that contain the regex below ### The regex below should be placed between "m#" and "#"  ### (this syntax is required when the string contains forward slashes) <IfModule mod_security.c>   <If "%{REQUEST_URI} =~ m#/admin/#">     SecFilterEngine Off     SecFilterScanPOST Off   </If> </IfModule>