{"id":1807612,"date":"2010-12-10T00:02:58","date_gmt":"2010-12-10T00:02:58","guid":{"rendered":"https:\/\/wordpress.org\/support\/topic\/mod_security-for-wordpress\/"},"modified":"2016-08-19T20:59:34","modified_gmt":"2016-08-19T20:59:34","slug":"mod_security-for-wordpress","status":"closed","type":"topic","link":"https:\/\/wordpress.org\/support\/topic\/mod_security-for-wordpress\/","title":{"rendered":"Mod_Security For WordPress"},"content":{"rendered":"<p>Okie, I think this is a common problem for all of us who are on a VPS or a Dedi. Mod Security does not play nice with WordPress and sometimes renders the site blank, generates error 500, kills comment posting and what not. On my blog <a href=\"http:\/\/www.nokiasymbianthemes.com\">Nokia Symbian Themes<\/a> it have had some issues in the past and though I think I have fixed almost all of em &#8211; there may always be more. After searching the web I found bits n pieces everywhere but nothing that is regularly updated &amp; tested to work.<\/p>\n<p>Hence I am starting this thread so that anyone with issues with mod_security and wordpress can bank in this thread \ud83d\ude42 for the solutions.<\/p>\n<p>This is so far what I have included in my Mod_Security Custom\/Whitelist setting which makes my site act kinda nicely so far:<\/p>\n<pre><code>&lt;LocationMatch &quot;\/wp-admin\/post.php&quot;&gt;\n  SecRuleRemoveById 300015 300016 300017 950907 950005 950006 960008 960011 960904\n  SecRuleRemoveById phpids-17\n  SecRuleRemoveById phpids-20\n  SecRuleRemoveById phpids-21\n  SecRuleRemoveById phpids-30\n  SecRuleRemoveById phpids-61\n&lt;\/LocationMatch&gt;\n\n&lt;LocationMatch &quot;\/wp-admin\/admin-ajax.php&quot;&gt;\n  SecRuleRemoveById 300015 300016 300017 950907 950005 950006 960008 960011 960904\n  SecRuleRemoveById phpids-17\n  SecRuleRemoveById phpids-20\n  SecRuleRemoveById phpids-21\n  SecRuleRemoveById phpids-30\n  SecRuleRemoveById phpids-61\n&lt;\/LocationMatch&gt;\n\n&lt;LocationMatch &quot;\/wp-admin\/page.php&quot;&gt;\n  SecRuleRemoveById 300015 300016 300017 950907 950005 950006 960008 960011 960904\n  SecRuleRemoveById phpids-17\n  SecRuleRemoveById phpids-20\n  SecRuleRemoveById phpids-21\n  SecRuleRemoveById phpids-30\n  SecRuleRemoveById phpids-61\n&lt;\/LocationMatch&gt;\n\n&lt;LocationMatch &quot;\/wp-admin\/options.php&quot;&gt;\n  SecRuleRemoveById 300015 300016 300017 950907 950005 950006 960008 960011 960904\n  SecRuleRemoveById phpids-17\n  SecRuleRemoveById phpids-20\n  SecRuleRemoveById phpids-21\n  SecRuleRemoveById phpids-30\n  SecRuleRemoveById phpids-61\n&lt;\/LocationMatch&gt;\n\n&lt;LocationMatch &quot;\/wp-admin\/theme-editor.php&quot;&gt;\n  SecRuleRemoveById 300015 300016 300017 950907 950005 950006 960008 960011 960904\n  SecRuleRemoveById phpids-17\n  SecRuleRemoveById phpids-20\n  SecRuleRemoveById phpids-21\n  SecRuleRemoveById phpids-30\n  SecRuleRemoveById phpids-61\n&lt;\/LocationMatch&gt;\n\n&lt;LocationMatch &quot;\/wp-includes\/&quot;&gt;\n  SecRuleRemoveById 960010 960012 950006\n  SecRuleRemoveById phpids-17\n  SecRuleRemoveById phpids-20\n  SecRuleRemoveById phpids-21\n  SecRuleRemoveById phpids-30\n  SecRuleRemoveById phpids-61\n&lt;\/LocationMatch&gt;<\/code><\/pre>\n<p>Some of these rules are WordPress Specific while some are plugin specific. Do you have anything else included that makes your wordpress &amp; the plugins act nicely with Mod_Security? If yes, then please post it so that we can compile the ultimate mod_security and wordpress specific whitelist ruleset!<\/p>\n<p>Cheers!<\/p>\n<p>Btw on my VPS &#8211; Running WP 3.03, Apache 2.2, CSF Firewall and E-Accelerator with PHP 5.2.<\/p>\n","protected":false},"template":"","class_list":["post-1807612","topic","type-topic","status-closed","hentry","topic-tag-mod-security","topic-tag-modsecurity","topic-tag-mod_security","topic-tag-vps"],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/1807612","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic"}],"about":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/types\/topic"}],"version-history":[{"count":0,"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/topic\/1807612\/revisions"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/support\/wp-json\/wp\/v2\/media?parent=1807612"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}