Articles in this section

See more

Cannot access website hosted in Plesk: the server responded with a status of 403 (ModSecurity Action)

Avatar
Alexander Tsmokalyuk
Updated
Follow
Plesk for Windows kb: technical ABT: Group A

Applicable to:

  • Plesk for Windows

Symptoms

  1. After activation of Atomic Professional ModSecurity at Tools & Settings > Web Application Firewall (ModSecurity), some clients cannot access websites:

    CONFIG_TEXT: Forbidden
    You don't have permission to access /roundcube/index.php on this server.

    CONFIG_TEXT: Failed to load resource: the server responded with a status of 403 (ModSecurity Action)

  2. Error in Chrome or Internet Explorer DeveloperTools:

    PLESK_INFO: HTTP Error 403.0 - ModSecurity Action You do not have permission to view this directory or page

    CONFIG_TEXT: Failed to load resource: the server responded with a status of 403 (ModSecurity Action)

  3. Error in Event Viewer > Windows Logs > Application:

    CONFIG_TEXT: Message: Access denied with code 403 (phase 1).
    RBL lookup of 2.113.0.203.xbl.spamhaus.org succeeded at REMOTE_ADDR (Illegal 3rd party exploits). [line "51"] [id "350000"] [rev "2"] [severity "ERROR"] Action: Intercepted (phase 1)

  4. Unable to issue SSL certificate with the following error in Plesk GUI:

    PLESK_ERROR: Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/12345. Details: Type: urn:ietf:params:acme:error:unauthorized Status: 403 Detail: During secondary validation: Invalid response from http://example.com/.well-known/acme-challenge/h9lLrpvgL9gsfgutUgerraF2aOas [203.0.113.2]: “[!DOCTYPE html PUBLIC \“-//W3C//DTD XHTML 1.0 Strict//EN\” \“http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"]\r\n[html xmlns=\“http”

    And the following entry in %plesk_dir%admin\logs\php_error.log:

    CONFIG_TEXT: Access denied with code 403 (phase 1). RBL lookup of 130.229.222.34.xbl.spamhaus.org succeeded at REMOTE_ADDR (Illegal 3rd party exploits). [file "C:/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_rbl.conf"] [line "51"] [id "350000"] [rev "2"] [msg "Global RBL Match: IP is on the xbl.spamhaus.org Blacklist (Report False Positives to www.spamhaus.org)"] [severity "ERROR"]

Cause

ModSecurity blocks access to the website from blacklisted IP address.

Resolution

To disable blocking for particular customer, white list his address.

To disable blocking based on blacklisting for all addresses, disable the rule:

  1. Log in to Plesk server via RDP
  2. Find ID of the rule that blocks the website in Event Viewer > Windows Logs > Application ().
  3. Login to Plesk as admin user
  4. Navigate to the tab  Tools & Settings > Web Application Firewall (ModSecurity) > General. 
  5. Add the rule ID mentioned in the error message to Security rule IDs field and press OK:
    rule.png

Comments

2 comments

Sort by Date Votes
  • Avatar
    Kotamaya Id

    I followed the steps above, but the website still shows 403 Forbidden.

    0
    Comment actions Permalink
  • Avatar
    Ivan Postnikov

    @Kotamaya, let me clarify, have you checked Event Viewer log?

    Have you added the rule number found in the log or taken it from the example in this article?

    In case the issue will persist, consider contacting Plesk Technical Support.

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles