This false positive may temporarily cause problems for you or your visitors accessing your website. Occasionally a rule will trigger under normal website usage, causing a false positive. It can be very difficult for these rules to accurately work when you factor in the potential for a huge number of different configurations, software versions and other server differences. Rules need to be manually written by developers and then applied to a server in order for them to work correctly. However, it's important to note that mod_security is a rule based system. Overall, mod_security is very reliable and accurate and will detect and block most common web application attacks. These rules are updated regularly by the Comodo team, so when new vulnerabilities and attacks are detected in the wild, our rules can be automatically updated to include detection for them - protecting your websites further against new attacks. The rules we are using currently come from Comodo, and are a public set of rules used by a large number of people worldwide. Think of it as a firewall for your website. Things like the browser they are using, the size of their request, the filename they are requesting and so on are all checked against these rules, and if anything abnormal or dangerous is detected, the request is blocked before it is processed by PHP or Litespeed.

When a request comes in to the server from a visitor trying to access your website, the request data and other pieces of information they send are scanned by mod_security for known attack signatures against a set of rules that we have saved server side. Essentially it acts as a web application firewall and sits between the web request itself and the server. Mod_security is a server side module for Apache that allows us to scan web requests and apply filters based on a huge range of criteria.

Comodo modsecurity cpanel