Mod_Security error - Hostgator

I have a website on Hostgator shared hosting. And I noticed sometimes when I try to login into an account (as a user, not as admin) behind a proxy, I get the Mod_Security error:

Not Acceptable!

An appropriate representation of the requested resource could not be found on this server. This error was generated by Mod_Security.

I kept saying I'll look into it tomorrow. But a user contacted me that he encountered the problem, so I contacted Hostgator support to see what's up. I know they can whitelist the error or whatever to fix such issues...

---

So I performed the action while I was talking to support, so that they can see the error in their logs or whatever. The guy saw it and said he whitelisted it. But then I tried again, and I got the error again.

Then he told me:

That is because of too many attempts to login to the WordPress dashboard. Please do not try to access the WordPress dashboard too many times or the Mod_Security error will occur.

So I opened an account and logged in and out of my the site 30 times, as fast as I could. I didn't get the error. So I told him.

He said:

Mod Security is put in place on our shared servers to help protect against potential attacks from hackers and excessive bot traffic. Rules get removed and added depending on trends that are noticed in how hackers are accessing people's sites. Unfortunately, well-intended actions can be blocked at times. We are unable to disable Mod Sec entirely, but we can whitelist rules that are causing issues on your site.

If you login to the WordPress dashboard multiple times within a short span, the system will think that it is a bot attack and put the error on the dashboard.

So I told him this:

I just logged in and out of the same account 10 more times. That's 30 times I did it, and very quickly. No error. But the other browser, where I am using proxies, the Mod Security error just appears whenever it wants. So it's not about logging in and out of an account. It must have something to do with proxies.

And he said:

Looks like it. I am checking on it for you.Thanks for your patience. I am stilll checking on the proxy issue.Thanks for your patience. I was not able to get the exact information on it. I will escalate the case to the technical department so that the admins can answer the query. The ticket ID is: ########.

---

So, we all know Hostgator support is shit.

I'm no expert with this stuff, but it just seems to me that someone who knows what the fuck they're doing could pinpoint the problem and fix it in 60 seconds.

I know you fuckers know what this is all about. So what am I dealing with here guys?

Thanks

Get a vps or droplet. Come on, shared hosting is for noobs / amateurs. You can get a Vps for as low as $5.

TiagoS said:

Get a vps or droplet. Come on, shared hosting is for noobs / amateurs. You can get a Vps for as low as $5.

Click to expand...

Noob is my middle name bro!

I actually don't have issues with the Hostgator shared hosting. I've been using the same hosting for 8 years, and the issues have been very few.

See, I don't bank by having tons of traffic, I bank on customers. So having a server that can handle a bajillion visitors per day or some complicated technobabble isn't a concern to me.

But this Mod_Security issue is a problem, because I can't have customers not being able to login to my site, ever! Even if they're using a proxy.

And I just feel the Hostgator support guy is a noob (so he's like my brother lol) and he could have fixed the issue if he wasn't a noob. So I ask here about my problem, maybe someone on the forum can point me in the right direction. And then I can point the next Hostgator noob I talk to in the right direction. And then maybe they can pinpoint the problem and fix it.

Scorpion Ghost said:

Noob is my middle name bro!

I actually don't have issues with the Hostgator shared hosting. I've been using the same hosting for 8 years, and the issues have been very few.

See, I don't bank by having tons of traffic, I bank on customers. So having a server that can handle a bajillion visitors per day or some complicated technobabble isn't a concern to me.

But this Mod_Security issue is a problem, because I can't have customers not being able to login to my site, ever! Even if they're using a proxy.

And I just feel the Hostgator support guy is a noob (so he's like my brother lol) and he could have fixed the issue if he wasn't a noob. So I ask here about my problem, maybe someone on the forum can point me in the right direction. And then I can point the next Hostgator noob I talk to in the right direction. And then maybe they can pinpoint the problem and fix it.

Click to expand...

If @Veil123 sees this I bet he can help you out.

Dude is a genius.

BassTrackerBoats said:

If @Veil123 sees this I bet he can help you out.

Dude is a genius.

Click to expand...

Then I really hope I get lucky and @Veil123 sees this thread

He's gotta help me, we're like neighbors... in an area of the world where historically it's all about good neighborly relations

Thanks bro

go for VPS, I don't really know why you bother going with a crappy shared hosting like Hostgator,
if you have a starting up website, you can check @DamoHG service (aka Hostgnome)
https://www.blackhatworld.com/seo/h...s-nvme-ssd-cpanel-linux-windows-3-99.1247073/
they have a pretty fast VPS for $4 monthly,
along with some free panel like aapanel (I use this, it's perfect), vestappanel or any alternative, you'll have x10 better performance, dedicated IP and full control without any crappy errors

Mod_Security is the so called 'firewall' that hosting companies (mostly) use for shared hosting (it is good to use it for VPS/Dedicated servers as well). They usually have a huge list of proxies and subnets loaded and it follows a pattern so your tries to do stuff using proxies won't work (in 95%+ of the cases).

When I had problems with the mod_security with Namecheap, I told them to remove the protection to the lowest possible layer and that I am taking the risk that comes with it - but that is only if the technician knows how to properly separate it for each client on the shared hosting.

Veil123 said:

Mod_Security is the so called 'firewall' that hosting companies (mostly) use for shared hosting (it is good to use it for VPS/Dedicated servers as well). They usually have a huge list of proxies and subnets loaded and it follows a pattern so your tries to do stuff using proxies won't work (in 95%+ of the cases).

When I had problems with the mod_security with Namecheap, I told them to remove the protection to the lowest possible layer and that I am taking the risk that comes with it - but that is only if the technician knows how to properly separate it for each client on the shared hosting.

Click to expand...

Cool. Thanks man. I already tried that, sort of...



Oh well. It is what it is. I'll wait for their technical department to get back to me, if they ever do, and we'll see what happens.

hideath said:

go for VPS, I don't really know why you bother going with a crappy shared hosting like Hostgator,
if you have a starting up website, you can check @DamoHG service (aka Hostgnome)
https://www.blackhatworld.com/seo/h...s-nvme-ssd-cpanel-linux-windows-3-99.1247073/
they have a pretty fast VPS for $4 monthly,
along with some free panel like aapanel (I use this, it's perfect), vestappanel or any alternative, you'll have x10 better performance, dedicated IP and full control without any crappy errors

Click to expand...

Let me try and explain something to you bro.

About 8 years ago I bought Hostgator hosting for 3 years, on Black Friday. I paid $86.38. That's for unlimited sites.

Then 3 years later I did the same thing, and I paid $89.55

Then 3 years later I did the same thing, and I paid $107.46

So that's about $280 spent on hosting for 9 years. All my websites are hosted there. The uptime is good, the speeds are acceptable, the customer support is... survivable.

I've made thousands of dollars with my websites over the years. IT WORKS.

So... you tell me of hosting that will cost me $280 for 9 years, for unlimited sites, and will work, and I will switch immediately!

TiagoS said:

Get a vps or droplet. Come on, shared hosting is for noobs / amateurs. You can get a Vps for as low as $5.

Click to expand...

I can agree with you regarding the pricing, but still VPS remains a kind of "shared hosting" as well

Oh boy, I got a similar problem with Mod_Security since yesterday and I had no way to access it on my cPanel (I use Namecheap hosting). So, I contacted Namecheap, told them to disable Mod_Security or to at least whitelist certain actions. They did and now it is working fine.

Any way for you to disable Mod_Security totally? So you won't run into this problem anymore?

nakamura said:

Oh boy, I got a similar problem with Mod_Security since yesterday and I had no way to access it on my cPanel (I use Namecheap hosting). So, I contacted Namecheap, told them to disable Mod_Security or to at least whitelist certain actions. They did and now it is working fine.

Any way for you to disable Mod_Security totally? So you won't run into this problem anymore?

Click to expand...

No, there's no way for me to do anything about it. Hostgator holds control over Mod_security like they hold onto their balls

Ok guys, I'm gonna remove this thread from my bookmarks and call it resolved.

Here is what they got back to me with:



So if anyone cares, there you go.

So, bullshit, whatever, who cares. This is not a huge issue for me. And I don't have the time or the energy to be dealing with it right now.

So I'll call this thread resolved. This is what we got. The end.

Hostgator is messed up. I have a cloud package and recently all my sites went down. When I contacted the support, they said my websites have been infected with malware. When I tried seeing error logs, it seemed like it happened from their end.

When I asked them to fix, they tried to promote me some Sitelock package which costs around $200. This is something that they do frequently I feel like. Afterwards I found that there are other people who had same type of problem and Hostgator tried to sell them Sitelock package to remove malware.

BrokenJamJar said:

Hostgator is messed up. I have a cloud package and recently all my sites went down. When I contacted the support, they said my websites have been infected with malware. When I tried seeing error logs, it seemed like it happened from their end.

When I asked them to fix, they tried to promote me some Sitelock package which costs around $200. This is something that they do frequently I feel like. Afterwards I found that there are other people who had same type of problem and Hostgator tried to sell them Sitelock package to remove malware.

Click to expand...

You get what you pay for I guess.

Or we get... what we pay for...

Scorpion Ghost said:

You get what you pay for I guess.

Or we get... what we pay for...

Click to expand...

Even someone is on budget, I wouldn’t recommend Hostgator tbh. Rather go with Hostinger. Never had this type of problem with them.

BrokenJamJar said:

Hostgator is messed up. I have a cloud package and recently all my sites went down. When I contacted the support, they said my websites have been infected with malware. When I tried seeing error logs, it seemed like it happened from their end.

When I asked them to fix, they tried to promote me some Sitelock package which costs around $200. This is something that they do frequently I feel like. Afterwards I found that there are other people who had same type of problem and Hostgator tried to sell them Sitelock package to remove malware.

Click to expand...

5+ years ago they blocked site of my client because I used htaccess rules to block the bots, specific hosts, malicious queries, etc. Their retarded sitelock is scanning for some keywords and they found some shit I was blocking like it was threat. Several days with several support fucktards and each of them at the end understood the situation but still tried to upsell that sitelock subscription. He happily moved to another hosting. fuck hostgator.

Been with HostGator for 20+ years with a reseller account, support quality is a crap-shoot for sure, but on a complex issue like mod_security, don't waste your time with Chat support, they don't know nothin, and will keep you on hold while they time-slice chatting with a senior rep whilst answering 20 other noob questions at the same time. Always use the phone, or be on hold while you waste your time with chat.

Luckily, simple luck I reached a senior engineer on Thanksgiving eve who helped troubleshoot the issue. I didn't want to disable mod_security to work around this, which is a real NOOB answer because it stops a lot of bad actors. She had me real-time recreate the error whilst watching my IP address in the logs. She was able to catch Mod_Security Rule # 39079 and create a white list for my payment-confirmation page that was throwing the error after successfully processing at Stripe.

Get a VPS? Really? NO THANKS. HostGator does a great job keeping up with security patches and are forward-looking when it comes to protecting shared and reseller accounts. It's in their best interest to be pro-active, versus fixing broken, infected stuff all the time.

So say you get the same error on your VPS, and IT Admins, being the lazy slobs as you well know, you take the quick and easy way out and disable , or white list the word to get around it for now and come back later to fix it right..... RIGHT.

Its a CRAZY idea to suggest "get a vps" just because of this. It won't make sloppy, bug riddled code run any better, but can help you hide or side-step the issue against best practices, "for now"