Account Security - UK Web Hosting | Dedicated Server Windows and Linux VPS Forum

**MonteJon** · #1 (**permalink**) 10-01-2008, 01:29

Hi all,
Following on from one of my other posts I'm a tad concerned about security on my account/domains.
I've had mod_sec disabled and wonder how vunerable my site is to hackers and others of their ilk now ?
How do I make my account CP secure and ensure no-one can pay a visit without my say so ?
Thanks for any advice,
Jon

**WelshTom** · #2 (**permalink**) 10-01-2008, 11:31

Mod_security doesn't prevent users to get into your control panel - instead, it stops scripts etc or SQL queries from being run in the URL.

If you need it for a particular piece of software to function, it is important to ensure you only disable it for that particular software, and nothing else. Make sure the software you are using is secure, and ensure to keep it up to date!

Even if it is disabled however, there is not really a cause for concern, providing the scripts you are using have been correctly coded.

**MonteJon** · #3 (**permalink**) 10-01-2008, 15:44

Hi Thomas,
First off I did'nt disable it, someone from your side of the fence did following a problem I had with one of my domains and I'm glad they did.
Secondly I've looked through all knowledge base articles and cannot find out how to do it for myself in future, can you either tell me how or point me in the right direction please ?
Many thanks,
Jon

**jc8654** · #4 (**permalink**) 10-01-2008, 15:58

I've never had to do this myself however I think it's adding "SecFilterEngine Off" to the .htaccess folder for the thing you're running.

For example, if you're running a forum in the directory "forum" put the above into the .htaccess file inside that folder and that will disable mod_security for that folder and all folders inside it.

**WelshTom** · #5 (**permalink**) 10-01-2008, 16:00

Hello.

You can disable mod_Security by using .htaccess.

For example, if you have a directory called /phpbb, and want to disable mod_security within that directory, create a .htaccess file within that directory, and put this inside it:

Code:

<IfModule mod_security.c>
 
    SecFilterEngine Off
 
    SecFilterScanPOST Off
 
</IfModule>

PUTTING THIS INSIDE A .HTACCESS FILE IN THE ROOT DIRECTORY WILL DISABLE MOD_SECURITY FOR *EVERYTHING* - SO PLEASE ENSURE TO ONLY PUT IT IN THE DIRECTORY FOR WHICH YOU WANT MOD_SECURITY DISABLED

**flesso** · #6 (**permalink**) 10-01-2008, 16:03

The following thread has been stuck in the PHP hosting for a while now and can be referenced to at any time if you need the mod_sec off code.

Link: mod_security Fix