Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to add the following line into my .htaccess file in order to get my website working with mod_security

SecFilterScanPOST Off

but then I get an error

Internal Server Error

The server encountered an internal error or misconfiguration and was unable to complete your request.

In my WebHost manager I see the following message: mod_security is installed and running!

I do not know what I did wrong?

share|improve this question

migrated from Jan 15 '10 at 12:52

This question came from our site for professional and enthusiast programmers.

Check apache logs for details – Ivan Nevostruev Jan 13 '10 at 16:29
In the logs I get the following message [Wed Jan 13 18:29:12 2010] [alert] [client .............] /home/..../public_html/.htaccess: Invalid command 'secfilterscanpost', perhaps mis-spelled or defined by a module not included in the server configuration – Roland Jan 13 '10 at 16:32

That module is probably not loaded. Try it within a <IfModule> block to avoid such error:

<IfModule mod_security.c>
    SecFilterScanPOST Off

But note that this doesn’t solve your problem. It just avoids that internal error.

To solve your problem, make sure that the mod_security module is loaded. This is done with the LoadModule directive.

share|improve this answer
In my WebHost manager I see the following message: mod_security is installed and running! – Roland Jan 13 '10 at 16:35
@Roland: Then your mod_security module is probably not intended to be used in a .htaccess file. Maybe it’s just allowed in the server/virtual host configuration. – Gumbo Jan 13 '10 at 16:46

You said in your comments than in your log file you can read "invalid command 'secfilterscanpost', perhaps mis-spelled or defined"

If you are using mod_security2, the SecFilterScanPOST is obsolete and you should migrate it to SecRequestBodyAccessas , this is explained in the migration document.

share|improve this answer
Very helpful link! – Elliot B. Oct 30 '13 at 17:57

Check your apache error log (on linux it is usually in /var/log/http/error_log or similar).

share|improve this answer

You can check if the SecFilterScanPOST directive is allowed in .htaccess files (probably via an AllowOverride option in your Apache or VirtualHost config file).

share|improve this answer

If your mod_security version is 2 or greater you can't put directives in a .htaccess file - only httpd.conf will do. I suppose they'll add this to the FAQ sooner or later.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.