ModSecurity on a cheap web hosting but I have no control over it: that is, the only thing the service provider lets you do is reading logs but, unfortunately, you can't really configure
This morning I found this log:
[Sun Sep 16 16:50:31 2018] [error] [client 184.108.40.206] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/usr/local/apache2/conf/modsecurity/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "65"] [id "960009"] [rev "2.1.1"] [msg "Request Missing a User Agent Header"] [severity "NOTICE"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_UA"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"] [hostname "www.example.com"] [uri "/firepro/newfile.txt"]
I verified this happens when my
PHP code simply tries to read and echo the contents of newfile.txt using
file_get_contents. This error breaks a Wordpress widget and renders it useless (it doesn't display any content, since the content is provided by the txt file overwritten every hour by PHP with the help of a cronjob).
What header is
ModSecurity expecting? Why do I need to specify a User Agent header?