How to Whitelist Specific ModSecurity Rules Automatically

arunkgovind

Hello,

We are running osTicket on a cPanel-hosted environment with ModSecurity enabled.

We are experiencing false-positive blocks caused by the following ModSecurity rule IDs:

941100
941800
981176

At the moment, we can disable ModSecurity entirely for the domain, but we would prefer not to do that. We only want to exclude these specific rules for the osTicket installation.

Is there a recommended way to include these exclusions as part of the osTicket installation/configuration, for example through .htaccess or another supported configuration file, so that these known false-positive rules are automatically whitelisted?

We previously tried adding something similar to:

<IfModule mod_security2.c>
SecRuleRemoveById 941100 941800 981176
</IfModule>

However, this resulted in a 500 Internal Server Error, which suggests that our hosting provider may not allow SecRuleRemoveById directives inside .htaccess.

What is the recommended approach for osTicket installations in shared/cPanel environments?

Ideally, we would like to:

Keep ModSecurity enabled.
Exclude only rules 941100, 941800, and 981176.
Apply the exclusion only to the osTicket installation rather than the whole server/domain.
Avoid having to manually request the exclusions again after reinstalling or upgrading osTicket.

Is there any osTicket-supported configuration or installation-level method for handling this?

Thanks.

KevinTheJedi

arunkgovind

osTicket is completely disconnected from ModSecurity; it sits behind it. So there is nothing you can do within the application itself. Every host is different so I would recommend contacting your host to see how to whitelist/ignore certain rule IDs whilst keeping ModSecurity enabled. Then post the fix here in case someone else runs into the same thing with the same host.

Cheers.