Software Development:
Individual Programming

Symptom

My website is basically accessible, but for some actions I only see a timeout in the browser. For example when I want to edit a page with the Elementor plugin in Wordpress.

In the web server error log (icon "Logs" in the web space control) I see entries like this:

[client ] ModSecurity: [file /etc/httpd/conf/modsecurity.d/rules/tortix/modsec/50_plesk_basic_asl_rules.conf"] [line "258"] [id "33350147"] [rev "143"] [msg "Protected by Atomicorp.com Basic Non-Realtime WAF Rules: Potentially Untrusted Web Content Detected"] [data ""] [severity "CRITICAL"] Access denied with code 403 (phase 2). Match of "rx ((?:submit(?:\\\\+| )?(request)?(?:\\\\+| )?>+|<<(?:\\\\+| )remove|(?:sign ?in|log ?(?:in|out)|next|modifier|envoyer|add|continue|weiter|account|results|select)?(?:\\\\+| )?>+)$|^< ?\\\\??(?: |\\\\+)?xml|^> ?$)" against "ARGS:actions" required. [hostname ""] [uri "/wp-admin/admin-ajax.php"] [unique_id "YGd3IS-RaDMGEBt0BJbDcABAAAn"], referer: https:// /wp-admin/post.php?post=24&action=elementor

Cause

The "Web Application Firewall" blocks unsafe access to the website. There is a section in the error log entry

[id ". . ."]

for example

[id "33350147"]

Solution

Enter the rule ID as a security exception rule into the "Web Application Firewall" (icon on the "Websites & Domains" page of the webspace control panel). It is possible that there are several different IDs in different log entries in the web server error log. Only grant an exception for the IDs that relate to your specific error situation. It is perfectly normal for some requests to be blocked. This is what the safety function is for. You should only switch off the web application firewall completely if necessary. After changing the settings of the web application firewall, it can take up to 15 minutes for the changes to take effect.

Overview of frequently asked questions