Disable ModSecurity on a Domain via .htaccess

ModSecurity is a powerful web application firewall, but it can occasionally flag legitimate traffic as malicious. If you need to disable it for a specific domain or path, a single line in your .htaccess file does the job.

Disabling ModSecurity

Add the following directive to the .htaccess file in the directory where you want ModSecurity turned off:

SecRuleEngine Off

That is it. Apache will stop evaluating ModSecurity rules for that directory and everything beneath it.

Scope and Placement

• Domain-wide: Place the directive in the .htaccess at the document root for that virtual host.
• Path-specific: Place it in the .htaccess inside the subdirectory you want to exclude.
• Single file: You can also use a <Directory> block in the Apache vhost config if you prefer server-level control.

Re-enabling ModSecurity

If you later need to turn it back on, simply remove or comment out the line:

# SecRuleEngine Off

Then reload Apache:

sudo systemctl reload apache2

Things to Keep in Mind

• Check your ModSecurity audit logs (/var/log/modsec_audit.log or equivalent) to identify which rule is triggering the false positive.
• If only one rule is the problem, consider using SecRuleRemoveById instead of turning the entire engine off.
• After making changes, test with the same request that was previously blocked to confirm the fix.

This approach gives you a quick, targeted way to stop a specific rule set from interfering with legitimate traffic without pulling the plug on your entire WAF.

• Security
• SysAdmin

• SysAdmin
• Security