• Our team is looking to connect with folks who use email services provided by Plesk, or a premium service. If you'd like to be part of the discovery process and share your experiences, we invite you to complete this short screening survey. If your responses match the persona we are looking for, you'll receive a link to schedule a call at your convenience. We look forward to hearing from you!
  • We are looking for U.S.-based freelancer or agency working with SEO or WordPress for a quick 30-min interviews to gather feedback on XOVI, a successful German SEO tool we’re looking to launch in the U.S.
    If you qualify and participate, you’ll receive a $30 Amazon gift card as a thank-you. Please apply here. Thanks for helping shape a better SEO product for agencies!
  • The BIND DNS server has already been deprecated and removed from Plesk for Windows.
    If a Plesk for Windows server is still using BIND, the upgrade to Plesk Obsidian 18.0.70 will be unavailable until the administrator switches the DNS server to Microsoft DNS. We strongly recommend transitioning to Microsoft DNS within the next 6 weeks, before the Plesk 18.0.70 release.
  • The Horde component is removed from Plesk Installer. We recommend switching to another webmail software supported in Plesk.

Issue ModSecurity lately feels offended by Wordpress in several customer installations, is triggered by rule 222212

Bitpalast

Bitpalast

Plesk addicted!
Plesk Guru
Since yesterday we are seeing several support cases were customers are locked out of their websites by fail2ban as it reacts to a ModSecurity 403 error. That is caused by rule 222212 in Wordpress installations, for example as follows:
Code: 
[client 77.123.123.12] ModSecurity: Warning. String match "get" at REQUEST_METHOD. [file "/etc/httpd/conf/modsecurity.d/rules/comodo_free/27_Apps_WPPlugin.conf"] [line "3792"] [id "222212"] [rev "2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "<domainname>"] [uri "/wp-admin/edit-comments.php"] [unique_id "Xn5TaY9yZoW9kX79a6a2gAAABBE"], referer: https://<domainname>/wp-admin/edit.php?ids=1
This seems to be occuring in several customer installations. It is always the 27_Apps_WPPlugin.conf that is complaining and always the 222212 rule. Customers are reporting that they were editing their websites while suddenly they are locked out. So actually, they are not doing anything harmful.

The solution of course is to exclude rule 222212 from Web Application Firewall (ModSecurity), but the question is: Why is this suddenly happening and who needs to do something about it? It cannot stay this way, because it means that likely a major part of Wordpress users will be affected and sooner or later lock themselves out by simply working on their websites.
 
Last edited:
Yes, I have seen that article before. However, in this case it seems that the one specific rule 222212 is suddenly triggered in many different customers' Wordpress installations where this previously was not triggered. So probably it's an issue with ModSecurity (the ruleset respectively). Maybe I'll need to find a way to let them know.
 
Is this the fix?
" If the free Comodo rule set is selected and WordPress is installed on a website, Fail2Ban can no longer block the Plesk server’s IP address after customers spend some time working in WordPress. (PPPM-11961) "
 
You must log in or register to reply here.

Similar threads

S
Issue Need Help Whitelisting GTM Noscript in Comodo WAF Rule 214540 on Plesk
Replies
1
Views
278
alvarezcruz
alvarezcruz
L
Resolved ModSecurity: Access denied with code 403 (phase 2). Match of "contains /wp-json/yoast/"
Replies
7
Views
9K
loman
L
brother4
Question Custom rules for Mod Seruity 3.0 Nginx - WordPress protection
Replies
2
Views
715
brother4
brother4
R
Issue Problem with web application firewall - file extension is restricted by policy
Replies
3
Views
2K
Linulex
Linulex
P
Issue my website not rendering in some countries due to modsecurity
Replies
0
Views
1K
pointsriver
P
Back
Top