Collect the domain, request path, time zone, timestamp, response code and a safe reproduction. Avoid recording passwords, payment data or private form contents in a support ticket.

1. Open ModSecurity Tools > Hits List in WHM with authorised access.
2. Locate the event matching the domain and reproduction time. Record the rule ID and available request details.
3. Open the rule information and compare its purpose with the application action. Check the underlying audit logs if the summary does not show the complete sequence.
4. Confirm that the request is legitimate and whether an application update or malformed payload explains the match.
5. Provide the verified rule ID and redacted evidence to the responsible administrator or rule vendor before planning a narrow exception.

The investigation should connect one reproducible request with the relevant protection event. A rule appearing nearby in time is not sufficient proof that it caused the user’s failure.

The Hits List displays a selected relevant hit, not necessarily every rule event for a request. A CDN firewall, application permission or web-server rule can also return a similar status. Avoid disabling ModSecurity across all domains while searching for the cause.

No. Audit details can contain request data and identifiers. Share the minimum necessary evidence through a trusted support channel and redact secrets while preserving the diagnostic fields.

• Applying a narrowly scoped ModSecurity exception as administrator
• Finding the error behind a cPanel website’s 500 response
• Downloading raw access logs for an incident investigation
• Changing the server root password in WHM

• cPanel: Modsecurity Tools
• cPanel: Apache Module Modsecurity