How to Enable ModSecurity with the OWASP Core Rule Set in WHM

ModSecurity is a web application firewall (WAF) built into Apache. It inspects each request to your websites and blocks common attacks, such as SQL injection and cross-site scripting, before they reach WordPress or other applications. On its own it does nothing: it needs a rule set that describes the attacks.

On cPanel servers, the rule set to use today is the OWASP Core Rule Set (CRS), which cPanel provides and updates. This guide sets it up, and explains why the Comodo rules that older guides (including an earlier version of this one) recommended should be removed.

Quick answer

1. In WHM › Software › EasyApache 4, customize the current profile:
   • under Apache Modules, make sure mod_security2 is installed;
   • under Additional Packages, select ea-modsec2-rules-owasp-crs;
   • review and Provision.
2. In WHM › Security Center › ModSecurity Vendors, check that the OWASP rule set is listed and On.
3. If the Comodo vendor is listed, delete it.

cPanel

What you need: root access to WHM on a server that uses Apache. (On LiteSpeed, ModSecurity rules are handled by LiteSpeed; see its documentation.)

Why not the Comodo rules?

For years, many cPanel guides recommended the free Comodo WAF rule set. It is no longer a safe choice:

• cPanel's ModSecurity documentation no longer mentions Comodo; the only rule set cPanel provides is OWASP CRS. cPanel
• In June 2025, a ModSecurity security update began checking rules properly, and an invalid rule in Comodo's set stopped Apache from starting on servers that used them. cPanel staff tried to contact Comodo and said that, as far as they could tell, the Comodo WAF rule set "is no longer being maintained". cPanel community

A rule set that is not updated does not protect against new attacks, and can break the web server after an update. If your server still uses Comodo rules, replace them with OWASP CRS as below.

Step 1: Install ModSecurity and the OWASP rules

1. Log in to WHM as root.
2. Go to Software › EasyApache 4.
3. Next to the profile currently in use, click Customize.
4. In Apache Modules, search for mod_security2 and make sure it is selected. cPanel
5. In Additional Packages, search for ea-modsec2-rules-owasp-crs and select it. cPanel
6. Go to Review and click Provision. Wait for it to finish.

This package version of the rules receives frequent updates and replaces any older OWASP rule set. cPanel (The vendor list may also show OWASP ModSecurity Core Rule Set V3.0 with an Install button; that older version is no longer updated, so use the package instead.)

Step 2: Check the vendor list

Go to WHM › Security Center › ModSecurity Vendors:

• The OWASP rule set should appear and be switched On, with updates enabled.
• If Comodo (or any other vendor you no longer use) appears, click Delete for it. This removes all of its rules.

cPanel

Step 3: Check ModSecurity is blocking

In WHM › Security Center › ModSecurity Configuration, the Rules Engine setting controls what ModSecurity does: cPanel

• Process the rules: inspect and block attacks. This is the normal setting.
• Process the rules in verbose mode, but do not execute disruptive actions: inspect and log only, without blocking.

The log-only mode is useful for a few days after you first enable the rules on a busy server: you can see what would be blocked in the hits list (next step) before it affects anyone. Then switch to Process the rules.

Step 4: Handle false positives

Sometimes a rule blocks a legitimate request, for example a WordPress editor saving a post with code in it. The visitor typically sees a 403 Forbidden page.

1. Go to WHM › Security Center › ModSecurity Tools. The Hits List shows recent rule events. cPanel
2. Find the hit for the blocked request (by IP address, domain or time) and note its Rule ID.
3. Click the Rule ID to view the rule, and Disable it if it is causing false positives.
4. Click Deploy and Restart Apache. cPanel

Vendor rules cannot be edited or deleted one by one, only disabled. cPanel Disable as few rules as possible; each one removes some protection for every site.

Turning ModSecurity off for one site

If a site cannot work with ModSecurity, its owner can switch it off for that domain in cPanel › Security › ModSecurity. cPanel strongly recommends leaving it on for all domains and only turning it off while troubleshooting. cPanel

If users do not see that page, enable the ModSecurity Domain Manager feature in WHM › Packages › Feature Manager. cPanel

Troubleshooting

Apache does not start after an update, with a syntax error in a file under modsec_vendor_configs/comodo_apache/. That is the Comodo problem described above. Delete the Comodo vendor in ModSecurity Vendors (or remove that folder), then restart Apache. Do not downgrade ModSecurity to get around it: the update fixed security vulnerabilities. cPanel community

Many false positives. Besides vendor rules, cPanel also loads custom rules from /etc/apache2/conf.d/modsec/modsec2.user.conf. Check that file for old custom rules. cPanel

The ModSecurity pages in WHM say the module is missing. Install mod_security2 in EasyApache 4, as in Step 1. cPanel