ModSecurity OWASP blocking GTMetrix

[bejbi]

If you are using OWASP rules v. 3.3.4 you can experience problem with GTmetrix service. All requests will serve 403 error.

It is interesting becouse probably GTmetrix sends forbidden header. GTmetrix is blocked by 3 rules:
920450 - request protocol enforcement
949110 - request blocking evaluation
980130 - response corelation

You can disable these rules or add GTmetrix to whitelist (if you need GTmetrix):
cPanel has tutorial for whitelisting: https://support.cpanel.net/hc/en-us...How-to-whitelist-an-IP-address-in-ModSecurity

:wq

 

[ciao70]

Hi,

The problem also occurs with other systems after the update of Modsecurity 2.9.6 and Owasp 3.3.4

Modsecurity 2.9.6 [Fix Security]

Hi, Do you use OWASP CRS? Yes, it is the ruleset causing the issues AFAIK, previously no problems at all.

forums.cpanel.net

Thanks