---
title: "Whitelisting ModSecurity Rules in WHM"
source: "https://docs.nexcess.com/hosting/control-panel/whm/security/whitelisting-modsecurity-rules-in-whm/"
description: "ModSecurity is a vital defense against malicious attacks. If accidental IP blocking happens, use the ModSecurity CMC plugin in WHM to whitelist IPs."
vertical: "Hosting"
date: "2024-03-04"
last_modified: "2026-08-04"
---

# Whitelisting ModSecurity Rules in WHM

ModSecurity is your sites first defense when it comes to malicious IP addresses and attacks by hackers. Sometimes, your own IP address or the IP of a specific user will be blocked because of an accidental rule violation. If this occurs, you will need to use the ModSecurity CMC plugin in WHM to whitelist the rule being broken and allow the IP access to your site.

Within this article, you will see how to:

- [Locate Blocked IP Addresses](#locate)
- [Modify the Global Rule Whitelist](#global)
- [Whitelist Rules per User](#user)
- [Whitelist Rules per Domain](#domain)
- [Whitelist Rules by DirectoryMatch](#directory)

| ### **Warning:** |
|---|
| Configserver’s ModSec Control plugin allows for rules to be edited if they are located in */usr/local/apache/conf/modsec\**. We strongly advise most users against editing rules directly, as an error can prevent your web server from being able to start. We advise whitelisting using the rule ID instead. |

## Locate Blocked IP Addresses

The first step to whitelisting a rule is to locate the blocked IP addresses. In order to do this, you will need to use the **Hits List** found in your ModSec Tools.

1. Navigate to your **Hits List** under **ModSecurity Tools**. If you need help navigating to your Hits List, see our article [Installing Configserver’s ModSecurity Control Plugin on Your Server](https://docs.nexcess.com/hosting/security/firewall-management/configserver-security-firewall-csf/installing-configservers-modsecurity-control-plugin-on-your-server/).  
    ![Hit List showing](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_61au8F.png)
2. Once in the **Hits List** page, you can see all websites and IP’s which have violated rules in your ModSecurity firewall.

You can search for your own IP address by using the search bar of the Hits List. If you’re not sure of your IP address, use [https://www.whatismyip.liquidweb.com](https://whatismyip.liquidweb.com) to find out. Once you input your IP address, any rules it has violated will show up in the Hits List.

## Global Rule Whitelist

If there is a rule affecting multiple domains, you can choose to whitelist rule globally. This means that the rule will allow traffic to come through on all domains and IP’s in your account.

1. From the Hits List, click the link for **Rule ID** to open the rule. Copy the Rule ID so that you can paste it into the ModSecurity rule ID List.  
    ![rule ID highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_RplFVS.png)
2. Navigate to the ConfigServer ModSecurity Control page in WHM and paste the Rule ID into the **ModSecurity rule ID** list.  
    ![rule pasted in rule id list](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_foDuEE.png)
3. Click **Save global whitelist**. Apache will restart and the rule will now be whitelisted to allow traffic to come through to your site.

## Whitelist Rules per User

If you have multiple user domains you’d like to whitelist a rule for, but not all domains in your account, you can use the **User Whitelist**.

1. Select the user domain you want to modify the rule for and click **Modify user whitelist**.  
    ![domain highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_PA8d7x.png)
2. This will take you to the whitelist page for the domain. Copy and paste the rule ID in the **ModSecurity Rule ID list** box.  
    ![domain rule id highlighted in whitelist](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_FIdykB.png)
3. Click **Save whitelist for all www(yourdomain) domains** button.  
    ![save whitelist button highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_mwJC6b.png)
4. Apache will restart and the rule ID will now be whitelisted for the selected user domains.

## Whitelist Rules per Domain

You can whitelist a rule for a specific domain under any user. This will only allow the rule to be bypassed for that domain, the rest will still be protected by the rule.

1. From the user whitelist home page, highlight the domain you want to whitelist the rule for and click **Modify domain whitelist**.  
    ![domain and modify domain whitelist button highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_42rPE2.png)
2. When the page opens, copy and paste the rule ID into the **ModSecurity rule ID list**.  
    ![rule pasted in rule id list](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_5vJtCf.png)
3. Click **Save whitelist for (yourdomain).com** and Apache will restart to whitelist the rule ID.

## Whitelist Rules by DirectoryMatch

Sometimes, a specific page on your site will need to have a rule ID whitelisted. This occurs most commonly with WordPress and the wp-admin page. You can whitelist a rule ID for a specific page using DirectoryMatch.

1. Select **New DirectoryMatch** and click **Modify by DirectoryMatch**.  
    ![new directory match highlighted and modify button highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_KbyeyE.png)
2. In order to whitelist a directory path, you will need to enter the entire expression to whitelist the page.  
    ![directory path entered and highlighted](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_8PZh2n.png)
3. Click **Add DirectoryMatch** to open the whitelist page for that specific path.
4. The page will open for you to copy and paste the rule ID to the whitelist.  
    ![rule pasted in rule id list](https://docs.nexcess.com/wp-content/uploads/2026/06/help.liquidweb.com_j4uxVp.png)
5. Click **Save Whitelist** and apache will restart to save the whitelist.