ModSecurity: Access denied with code 403 Nginx / Apache Origin: Edge & web server OSI layer 7 · Application Last updated 5 Nov 2026

Nginx/Apache: ModSecurity: Access denied with code 403 (phase 2). Matched "Operator GE matched 5 at TX:anomaly_score"

The ModSecurity WAF (OWASP Core Rule Set) blocked the request as suspicious.

Exact message you may see ModSecurity: Access denied with code 403 (phase 2)ModSecurity: Access denied with code 406[id "942100"] [msg "SQL Injection Attack Detected via libinjection"]ModSecurity: Warning. Matched phraseAccess denied with code 403 (phase 2). Matched "Operator GE matched
Explore the map of this error Full error map →
Seen on: Nginx Apache Linux

Meaning

Read the audit log (/var/log/modsec_audit.log or Apache/Nginx error log) for the rule ID ([id "942100"]). If it's a false positive, tune the rule: SecRuleRemoveById 942100 for that location, adjust the anomaly threshold, or whitelist parameters. Don't disable the WAF globally.

Common causes

  • CRS rule (SQLi/XSS) matching legitimate input
  • JSON/WYSIWYG content tripping rules
  • Anomaly score threshold too strict
  • API clients with unusual headers
  • File uploads

⚡ Quick fix

  1. Find the rule id in the log and exclude it for that path: SecRuleRemoveById 942100
  2. Use SecRuleUpdateTargetById to exclude a parameter
  3. Raise the anomaly threshold gradually; test with DetectionOnly first

Detailed fix by platform

Apache

  1. SecRuleEngine DetectionOnly while tuning; then <LocationMatch "/admin/save"> SecRuleRemoveById 942100 </LocationMatch>

How to diagnose

  1. Rule ID — In the log?
  2. Input — Legitimate?
  3. Scope — Narrow exclusion?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Edge & web server. Errors that are often confused with or caused by this one (click to open):

1020 — Cloudflare Error 1020: Access Denied (Cloudflare)1020403 — HTTP 403 Forbidden (HTTP)403414 Request-URI Too Large / 400 Request Header Or Cookie Too Large — Nginx: 400 Bad Request — Request Header Or Cookie Too Large / client sent too long header line (Nginx / Apache)414 Request-URI Too L…499 Client Closed Request / client prematurely closed connection — Nginx: [info] client prematurely closed connection while reading response header from upstream / access log status 499 (Nginx / Apache)499 Client Closed Req…accept4() failed (24: Too many open files) — Nginx: [crit] accept4() failed (24: Too many open files) / open() failed (24: Too many open files) (Nginx / Apache)accept4() failed (24:…AH00015: Unable to open logs — Apache: AH00091: apache2: could not open error log file /var/log/apache2/error.log. AH00015: Unable to open logs (Permission denied) (Nginx / Apache)AH00015: Unable to op…AH00037: Symbolic link not allowed or link target not accessible — Apache: [core:error] AH00037: Symbolic link not allowed or link target not accessible: /var/www/html/current (Nginx / Apache)AH00037: Symbolic lin…AH00526: Syntax error on line of apache config — Apache: AH00526: Syntax error on line 12 of /etc/apache2/sites-enabled/site.conf: Invalid command 'Foo', perhaps misspelled or defined by a module not included in the server configuration (Nginx / Apache)AH00526: Syntax error…ModSecuri…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.