Fix ModSecurity 403 Forbidden False Positive Caused by Cookies on CWP / Apache /

Problem

After enabling ModSecurity for a domain, the website may suddenly show:



This can happen even when the website itself is clean and working correctly.

In my case, the issue appeared on a WordPress / WooCommerce website after enabling ModSecurity with COMODO WAF rules on a CWP server.

The Apache error log showed something like this:



The important parts are:



In this case, ModSecurity was not blocking a real attack. It was falsely detecting a normal tracking/marketing cookie as a SQL injection attack.

The cookie was:



This cookie is commonly created by Sourcebuster or marketing/tracking plugins used by WordPress and WooCommerce websites.

Important

Do not disable ModSecurity completely.

Also, do not disable all SQL injection protection rules globally.

The correct solution is to exclude only the specific safe cookie from the specific ModSecurity rule that is causing the false positive.

Step 1: Find the exact ModSecurity rule ID

Run:



Replace:



with the real domain.

Look for:



and also check what variable was blocked, for example:



Example

If the log says:



then the rule ID is:



and the problematic cookie is:



Step 2: Add a safe ModSecurity exclusion

On CWP with COMODO WAF, create a custom rule file:



Add:




This does not disable rule 218500.

It only tells ModSecurity not to inspect these specific harmless cookies with that rule.

Step 3: Test Apache configuration

On some CWP servers, apachectl may not exist in PATH.

Use:



If the syntax is OK, restart Apache:



Step 4: Test the website

Clear browser cookies for the domain or open the site in an incognito/private browser window.

Then watch the log live:



Refresh the website.

If the fix worked, you should no longer see new errors like:



General rule for any domain

The same method can be used for any false positive.

You only need to replace:



with the actual ModSecurity rule ID from your logs.

And replace:



with the exact variable that was falsely blocked.

Example format:



or:



Do not whitelist blindly

Some ModSecurity blocks are real attacks.

For example, this is a real scan and should stay blocked:



Requests for files like:



are hostile scans and should remain blocked.

Summary

If enabling ModSecurity causes a normal website to show 403 Forbidden:

1. Check the Apache or ModSecurity logs.
2. Find the exact rule ID.
3. Find the exact cookie, argument, or request variable being blocked.
4. Exclude only that specific variable from that specific rule.
5. Do not disable ModSecurity completely.
6. Do not disable important rules globally unless absolutely necessary.

This keeps the website usable while preserving ModSecurity protection.