# Managing the ModSecurity module in cPanel

> Turn the ModSecurity web application firewall on or off for your domains in cPanel and know when disabling it is safe.

Source: https://helpcenter.ruachost.com/cpanel/security/managing-the-modsecurity-module-in-cpanel/

**ModSecurity** is an Apache web application firewall (WAF) that adds an extra layer of protection to your websites. It helps detect and block common attacks before they reach your applications.

## About ModSecurity

- Provides **HTTP request filtering**.
- Protects against common exploits such as SQL injection, cross‑site scripting (XSS), and other malicious requests.
- Enabled by default in cPanel for all domains.

## Managing ModSecurity in cPanel

### 1. Accessing ModSecurity

1. Log in to **cPanel**.
2. On the **Tools page → Security section**, click **ModSecurity**.

### 2. Disabling ModSecurity

- You may need to disable ModSecurity temporarily if an application does not function correctly with it enabled.
- Options:

  - **Disable for all domains** → Under *Configure All Domains*, click **Disable**.
  - **Disable for a specific domain** → Under *Configure Individual Domains*, locate the domain and click **Off**.

### 3. Enabling ModSecurity

- To re‑enable protection:

  - **Enable for all domains** → Under *Configure All Domains*, click **Enable**.
  - **Enable for a specific domain** → Under *Configure Individual Domains*, locate the domain and click **On**.

## Important Notes

- ModSecurity is **enabled by default**.
- If your application breaks when ModSecurity is active, disable it temporarily and test.
- For persistent issues, open a [Support ticket](https://dashboard.ruachost.com/submitticket.php?step=2&deptid=3), so we can investigate further.
- More technical details are available on the [ModSecurity GitHub wiki](https://github.com/owasp-modsecurity/ModSecurity/wiki).