My site is down! Too many bad login attempts, ModSec and other fun.

Or maybe it's not. If you check your website from your smartphone (while it's on your cellular connection; not your local wifi) or another network, does your site show up? If so, you've likely been blocked. This can happen if:

• You've made too many failed login attempts, or if
• Your website's software attempted something the server said was illegal.

The latter here happens sometimes. You're just working along, minding your own business, when all of a sudden, your site just stops responding to you. The best thing to do is to first, check from another network to see if your site is still up. If it is, you've been blocked! To resolve this:

1. Go to http://ip.levaire.com and send us your IP address (at support [at] levaire.com). Let us know you've been blocked and that you just need your IP delisted from the firewalls. Also let us know what site you were working on at the time.
2. We'll open a ticket with the datacenter on your behalf and send you the update once they've removed you.

Why this happens

Modsec (short for "module security") blocks, often pop up more frequently after a cpanel update. Sometimes the rules whitelisted previously get blasted. We will let our datacenter technicians know to whitelist the rule in /usr/local/apache/conf/modsec2/lw_whitelist.conf. This will ensure the whitelist won't get overwritten by future cpanel updates.

With modsec issues, you can whitelist the IP or the rule. You seldom want to whitelist the IP. If the customer's IP changes, they're likely to trip the rule again. If you whitelist the rule, it insulates others on the server from experiencing the same issue (including baddies from the Ukraine trying to hack into a site; there are disadvantages with any whitelisting.)