# Nginx/Apache: ModSecurity: Access denied with code 403 (phase 2). Matched "Operator GE matched 5 at TX:anomaly_score"

**Code:** `ModSecurity: Access denied with code 403` · **Category:** Nginx / Apache · **Seen on:** Nginx, Apache, Linux

The ModSecurity WAF (OWASP Core Rule Set) blocked the request as suspicious.

## Meaning

Read the audit log (`/var/log/modsec_audit.log` or Apache/Nginx error log) for the rule ID (`[id "942100"]`). If it's a false positive, tune the rule: `SecRuleRemoveById 942100` for that location, adjust the anomaly threshold, or whitelist parameters. Don't disable the WAF globally.

## Common causes

- CRS rule (SQLi/XSS) matching legitimate input
- JSON/WYSIWYG content tripping rules
- Anomaly score threshold too strict
- API clients with unusual headers
- File uploads

## Quick fix

1. Find the rule id in the log and exclude it for that path: `SecRuleRemoveById 942100`
2. Use `SecRuleUpdateTargetById` to exclude a parameter
3. Raise the anomaly threshold gradually; test with `DetectionOnly` first

## Detailed fix by platform

### Apache

1. `SecRuleEngine DetectionOnly` while tuning; then `<LocationMatch "/admin/save"> SecRuleRemoveById 942100 </LocationMatch>`

## How to diagnose

1. **Rule ID** — In the log?
2. **Input** — Legitimate?
3. **Scope** — Narrow exclusion?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/nginx-apache/modsecurity-access-denied-403)