Namecheap LiteSpeed Problem when Posting data from html form

Question

I am facing a problem when trying to post data to my PHP from html form. The issue is as follows:

When I submit less data like a 1 paragraph of Lorem Ipsum it works fine.
Submitting more paragraphs it fails instantly with error 403 Forbidden.
Tried solving using SecFilterScanPOST Off on .htaccess but to no avail.

` SecRuleEngine Off SecRequestBodyAccess Off ` what about this ? — qtwrk, Apr 15 '22 at 12:26

score 5 · Answer 1 · answered Jun 21 '22 at 15:54

To solve this error, @qtwrk's comment is correct that you must use the following code in your .htaccess.

<IfModule mod_security.c>
SecRuleEngine Off
SecRequestBodyAccess Off
</IfModule>

WordPress running on Litespeed Server will often fail with a 403 error when you try to post any content while creating new pages and posts in WP Admin. This code solves that issue.

score 0 · Answer 2 · answered Dec 11 '22 at 17:00

A solution about disabling should help but it decreases security — stops doing that.

Better to spend more time understanding the main reason and for example configure mod_security for Wordpress:

Based on this article you can disable some rules directly for wp-admin directory:

<LocationMatch "/wp-admin/">
  SecRuleRemoveById 300013
  SecRuleRemoveById 300014
  SecRuleRemoveById 300015
  SecRuleRemoveById 300016
  SecRuleRemoveById 300017
</LocationMatch>

Based on this article you can disable some rules directly for sub-directories:

<LocationMatch "/wp-admin/admin-ajax.php">
  SecRuleRemoveById 300013
  SecRuleRemoveById 300015
  SecRuleRemoveById 300016
  SecRuleRemoveById 300017
  SecRuleRemoveById 949110
  SecRuleRemoveById 980130
</LocationMatch>
<LocationMatch "/wp-admin/page.php">
  SecRuleRemoveById 300013
  SecRuleRemoveById 300015
  SecRuleRemoveById 300016
  SecRuleRemoveById 300017
  SecRuleRemoveById 949110
  SecRuleRemoveById 980130
</LocationMatch>
<LocationMatch "/wp-admin/post.php">
  SecRuleRemoveById 300013
  SecRuleRemoveById 300015
  SecRuleRemoveById 300016
  SecRuleRemoveById 300017
  SecRuleRemoveById 949110
  SecRuleRemoveById 980130
</LocationMatch>

If you want to be sure that mod_security is used you can wrap the settings above in this:

<IfModule mod_security.c>
  # ...
  # <LocationMatch ...>
  # ...
</IfModule>

Namecheap LiteSpeed Problem when Posting data from html form

2 Answers2