Not Acceptable! An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security

Question

I'm new to moodle environment and I'm having this error:

Not Acceptable!

An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.

I haven't done anything, I'm just viewing the registered users in my website:
http://www.joyfementira.com/dnsc/it14lms
I've noticed that my profile picture is not properly loaded so I clicked on it (picture's position), and after that the error came out.

What probably caused this error and how would I fix it?

Mine situation was kind of weird, one of my folders was named 'administrator', until changed it (after trying all the methods above) then my server allowed my files contained in it to pass the 406 error — Fikayo Adepoju, Dec 16 '16 at 12:00
@FikayoAdepoju I have wasted 4 hours trying to find the cause of the error and at the end your folder name solution worked. — Syed, Jan 28 '21 at 19:44

Sleek Geek · Answer 1 · 2021-02-12T22:28:12.667

12

Just to add to the answers. If this happens while you are trying to login to a WordPress website admin and you are using any type of VPN on your machine, you'd have to turn it off to solve the problem.

If you turn off your VPN, you'd be able to login without experiencing the issue.

edited Feb 12 '21 at 22:28

answered Jun 01 '20 at 09:08

Sleek Geek

4,638
3
27
42

Opposite for me. HostGator didn't like my local ISP assigned IP address but was ok with my VPN provider, go figure. Thx for the tip. – Philip Ingram Mar 15 '23 at 20:10

score 11 · Answer 2 · answered Oct 30 '19 at 23:27

11

I was experiencing same issue with my WP site shared-hosted in HostMonster. I resolved simply by accessing to the server via SSH and added the following lines on the .htaccess file :

<IfModule mod_security.c>
  SecFilterEngine Off
  SecFilterScanPOST Off
</IfModule>

answered Oct 30 '19 at 23:27

cryptolucio

111
1
4

1

This worked for me. I added the above lines in .htaccess – WhiteHorse Nov 21 '20 at 06:32

score 5 · Answer 3 · answered Sep 14 '17 at 18:46

Apache has a mod_security tool that tries to block SQL injections by url. This rule is also blocking some real urls. The solution is:

access WHM in your dedicated server
search for mod_security tools
check if it's blocking some urls
click in the rule id
click in deploy and Restart Apache

if you don't have access to WHM in your server. Pass this issue to your server administrator.

This is the rule that was blocking my urls

SecRule REQUEST_HEADERS|XML:/*|!REQUEST_HEADERS:Referer "\b(\d+) ?= ?\1\b|\'\"[\'\"] ?= ?[\'\"]\2\b" \ "phase:2,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:replaceComments,t:compressWhiteSpace,t:lowercase,ctl:auditLogParts=+E,log,auditlog,msg:'SQL Injection Attack',id:'959901',tag:'WEB_ATTACK/SQL_INJECTION',logdata:'%{TX.0}',severity:'2'"

score 4 · Accepted Answer · answered Mar 25 '16 at 20:29

4

This error will appear in some sites if cookies are turned off and mod_security requires cookies to match session data. It is suppossed to make things more secure... it ends up just annoying. Especially because web indexing crawlers like googleBot and other search engines do not use cookies, so THEY see this error instead of your site.

answered Mar 25 '16 at 20:29

Eric Sebasta

225
1
7

17

Do what is the solution then? – Dushyant Joshi Nov 27 '16 at 13:30
I used FF's do not track feature. Switching to Chrome (without this feature activated) allowed me to authorize the Gmap Oauth app from withing Wordpress. Hope that helps. – n3rd Oct 04 '18 at 16:45
have cookies turned on, or modify your mod_security settings, or do not use mod_security, or know that this is likely how search engines will see your site. using a vpn can sometimes create this error as well for reasons beyond the scope of this answer. – Eric Sebasta Jan 19 '21 at 17:42

Tim · Answer 5 · 2015-01-26T11:34:54.290

Do you have experience in setting up servers? Is this hosted by yourself or is it a shared hosting package?

The reason I ask is because this is a server-side (Apache) issue.

First, make sure your .htaccess file doesn't have any silly rules in it. The error arises because the server is denying access.

Second, make sure your file permissions are set up correctly. Generally speaking, you want directories to be 7/0/0 or 7/5/0 and files to be 6/0/0 or 6/4/0.

Read this for more details on Moodle security guidelines.

As for the profile picture issue, I'm not entirely sure what you're referring to so unfortunately I'm unable to answer that question. I doubt the two issues are related from the sounds of things.

score 2 · Answer 6 · answered Apr 11 '19 at 22:35

I'm writing scripts to communicate from one server to another and I don't own either servers and cannot change any settings. I was getting the Not Acceptable error with some embedded URLs but not others. For example this one gets Not Acceptable: http://magic.kayaker.net/simlink.php?avname=http://junk.com While this one does not: http://magic.kayaker.net/simlink.php?name=http://junk.com (fails whether I escape the query or not) The second one gets an unknown command, which is an error my script generates, the first one returns the not acceptable without ever running my php script. My solution has been to strip the http:// off all URLs and have the scripts on both ends put it back on.

score 1 · Answer 7 · answered Jul 04 '17 at 09:43

1

In my case, I received this error when sending to viewer file wrong path to the file it needed to view.

err: example.com/subDir/myViewer.php?file=%27../../myImages/myFile.gif%27
fix: example.com/subDir/myViewer.php?file=%27../myImages/myFile.gif%27

answered Jul 04 '17 at 09:43

Atara

3,523
6
37
56

score 1 · Answer 8 · edited May 14 '19 at 10:12

1

It had the same problem when enter a link in a form. It's is not the http:// or https://

In the form i had

<input type='text' name='demo'>

The name='demo' wasn't accepted anymore. I altered name='demo' into name='link' and solve it.

edited May 14 '19 at 10:12

vimuth

5,064
33
79
116

answered May 14 '19 at 09:54

Willem van Eekelen

11
2

score 1 · Answer 9 · answered Oct 23 '20 at 06:53

1

Most of the time this error occurs due to location. in my case, that was also an IP issue. Use any FREE VPN to fix this issue for a permanent solution you can contact your hosting provider to white list your IP.

answered Oct 23 '20 at 06:53

Saad Abbasi

745
11
25

score 1 · Answer 10 · answered Jul 12 '22 at 13:08

1

Using HTTP header in request helped in my case headers = {'user-agent': ...} requests.get(url, headers=headers)

answered Jul 12 '22 at 13:08

Abzetdin Adamov

71
1

score 0 · Answer 11 · answered Sep 27 '19 at 06:37

0

I had the same error when submitting a form to insert values into a database. The issue was that one of the form inputs was a link (with https). Once I took that input out, the error stopped showing up.

answered Sep 27 '19 at 06:37

XX123

1

score 0 · Answer 12 · answered Dec 28 '19 at 13:45

...In my case I was trying to save a Wordpress menu, with a link that pointed to #process (a div´s ID)...changed the #process to #ourprocess and it worked...

pretty strange if you asked me, but as real as it gets, I was able to replicate the issue more than 10 times. It is definitely the URL of the link that is blacklisted...

so, if you are using Wordpress in a shared hosting (in my case is Bluehost) it could be this... or something similar.

score 0 · Answer 13 · answered Oct 14 '20 at 23:12

0

If this is on WordPress, You just need to contact your hosting provider, They will white list your IP

answered Oct 14 '20 at 23:12

Khn Rzk

1,124
2
15
26

score 0 · Answer 14 · answered Jun 29 '22 at 11:41

0

For me it was a missing Content-Type header in my Insomnia requests!

Shout out to this blog post:

https://clay-atlas.com/us/blog/2021/10/17/wordpress-en-not-acceptable-mod-security/

answered Jun 29 '22 at 11:41

Mike Axle

1,086
11
25

score -1 · Answer 15 · answered Mar 16 '21 at 08:02

-1

Encountered same issue today.

I was trying to access wordpress admin dashboard with browsec vpn turned on.

I turned it off and issue was resolved in seconds.

answered Mar 16 '21 at 08:02

Prem Sagar

147
2
8

duplicate suggestion. TBF, this & another post saying the same, both read borderline like Comments than Answers. An explanation as to why this occurs, or why turning off the VPN makes the issue go away, or a link to documentation would vastly improve either post, shaping them into quality Answers. Without adding additional info, it'd be better to upvote the existing post. SO is not a forum. To work as intended, it must be interacted with differently. Each platform has different strengths.This comment is for onboarding to help learn SO platform. We appreciate your enthusiasm to participate. – SherylHohman Mar 17 '21 at 03:35

Not Acceptable! An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security

15 Answers15

Linked