Disabling rules using .htaccess

This is a new feature in modsecurity 2.7.3. This capability is available if you compile modsecurity using this option:

--enable-htaccess-config

From there, you will be able to disable rules using .htaccess files. The format to disable a rule via .htaccess is:

SecRuleRemoveById 12345

Where 12345 is the rule id.

Note: This capability is not enabled by default in modsecurity, and must be enabled specifically when modsecurity is compiled. If .htaccess directives do not work for you, then modsecurity is either not version 2.7.3 or higher and/or this option has not been enabled.

Warning: Enabling this capability will allow users to disable rules, including on compromised accounts which may cause the system to become compromised. This capability was specifically disabled by default in modsecurity to prevent this from occurring. Use this option with extreme caution!

Specific actions available in .htaccess

• SecAction
• SecRule
• SecRuleRemoveByMsg
• SecRuleRemoveByTag
• SecRuleRemoveById
• SecRuleUpdateActionById
• SecRuleUpdateTargetById
• SecRuleUpdateTargetByTag
• SecRuleUpdateTargetByMsg

Note: This capability is not enabled by default in modsecurity, and must be enabled specifically when modsecurity is compiled. If .htaccess directives do not work for you, then modsecurity is either not version 2.7.3 or higher, or this option has not been enabled.

Warning: Enabling this capability in modsecurity can allow an attacker to disable modsecurity rules that you may be using to protect the entire server. We do not recommend you enable this capability on a shared server.