mod_security

[timg]

I just moved one of my sites from here to another host. It's using some Lightbox and scroller javascript; it ran great on my Dathorn account. But at the other host, everything went wonkly. (Getting 500 errors.) The host's support says that mod_security is detecting problems. Support there said this was the error:

mod_security-message: Access denied with code 500. Pattern match "(ephedrine|neurontin|glucosamine|testosterone|cia lis|lipitor|effexor|propecia|celebrex|gluclosamine |lexapro|ephedra|levitra)+[\\w\\-_.]*\\.[a-z]{2,}" at HEADER("Referer") [severity "EMERGENCY"]

I think there's something screwing going on with their mod_security, as I also generated a mod_security error when I contacted their support about the site. I find it very odd that this site has always displayed fine from my Dathorn account from day one, but not at the other host. Is there more than one version of mod_security?

By the way, the site is for a real, getting-dirty concrete finishing business. And the scripts certainly don't have anything to do with the garbage mentioned in the mod_security message above.

[AndrewT]

The difference isn't really with mod_security but with their mod_security rules. Every host will tend to have different rules.

You may want to try adding this to your .htaccess file to disable the filtering:

SecFilterEngine Off

[timg]

Thanks, Andrew. Altering the .htaccess code like that kills the site altogether.

[AndrewT]

You can ask your other host if you can get mod_security disabled on the domain entirely but they may or may not allow this. Aside from that you may simply need to figure out why that rule is being triggered and correct the problem.

[timg]

I don't think it's something I can correct myself. I figured out that it's the domain name as such. The site actually displays fine from the alias. But when I use the domain name (gpconcretespecialist.com), it's a no go. The kicker is that their support system uses the same mod_security rules, and whenever I even mention the domain name in the support ticket, it doesn't go through (500 error).

[timg]

Haha! Sure enough, it was the domain name. Check this out:

gpconcretespecialist.com

gpconcretespecialist.com

Notice the letters in bold.

[AndrewT]

Yep, you're out of luck there. Those are some spectacular mod_security rules that they have running...jeez

[timg]

Yep, you're out of luck there. Those are some spectacular mod_security rules that they have running...jeez

Well, thankfully, I'm not out of luck, as the host changed the rule.

It's amusing to think about (now that the stress is past) - how many legit sites use "specialist" in the name?

[Frank Hagan]

Do you find it at all ironic that you moved the site away from here, yet got the best support not from your new vendor but from Andrew?

[ZYV]

Ha-ha, nice one, Frank!