Mod Security whitelist one file

Un Area

Well-Known Member
Nov 16, 2006
90
1
156
Hi there, Im having a issue with mod_security and a wordpress site. The thing is that Im using the Android Wordpress app to connect remotely to the site but I get a 403 error to the xmlrpc.php file:

- - [27/May/2018:14:48:51 -0300] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Moto G Play Build/MPI24.241-2.47-19-1; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.158 Mobile Safari/537.36 wp-android/10.0"
- - [27/May/2018:14:48:51 -0300] "POST /xmlrpc.php HTTP/1.1" 403 219 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Moto G Play Build/MPI24.241-2.47-19-1; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.158 Mobile Safari/537.36 wp-android/10.0"
- - [27/May/2018:14:48:54 -0300] "POST / HTTP/1.1" 200 63423 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Moto G Play Build/MPI24.241-2.47-19-1; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.158 Mobile Safari/537.36 wp-android/10.0"

So seems that modsecurity is blockin the access to that file. Is there a way to exclude that file from .htaccess?

I used this but I get a 500 error on the site

<Files xmlrpc.php>
SecFilterInheritance Off
</Files>

Thanks!
 

Un Area

Well-Known Member
Nov 16, 2006
90
1
156
I tried this rule but no effect:

<IfModule security2_module.c>
<Files xmlrpc.php>
SecFilterInheritance Off
</Files>
</IfModule>
 
Last edited:

cPanelLauren

Product Owner II
Staff member
Nov 14, 2017
13,274
1,292
313
Houston
Hi @Un Area

I'm glad you were able to find a resolution to your issue but I do agree with @Tearabite you may want to make sure that you were actually hitting a modsec rule and that you disable just that rule leaving xmlrpc.php open to everyone may present some issues in the future.

Thanks!