Overview

If a previously working API endpoint on your website (e.g., /api/v1/resource) suddenly starts returning a 403 Forbidden error—especially when using custom HTTP headers such as X-API-Key—the request is likely being intercepted and blocked by ModSecurity (Web Application Firewall).

ModSecurity protects your website by scanning incoming traffic. When security rules are updated, non-standard HTTP headers or API payloads may occasionally be flagged as false positives and blocked before reaching your application.

Step-by-Step: How to Identify & Resolve ModSecurity API Blocks

Step 1: Confirm the Error in Plesk

1. Log into your Plesk Control Panel.

2. Go to Websites & Domains and select your domain name.

3. Click on Logs in the domain dashboard.

4. Set the log filter to display Error logs or search for 403.

5. Look for entries mentioning ModSecurity: Access denied or [id "XXXXXX"]. Note down the Rule ID number listed in the log entry.

Step 2: Whitelist the ModSecurity Rule in Plesk

Once you have identified the Rule ID causing the false positive, you can disable that specific rule for your domain without turning off your overall firewall protection:

1. In Plesk, go to Websites & Domains -> Web Application Firewall (ModSecurity).

2. Scroll to the section labeled Switch off security rules.

3. In the text field, enter the Rule ID (e.g., 920420 or 211540) that was triggered in your logs.

4. Click OK or Apply.

Allow up to 1–2 minutes for the web server to reload the configuration. Test your API endpoint again using your X-API-Key header.

Need Extra Help?

If you cannot locate the ModSecurity Rule ID in your logs, or if you prefer a support specialist to safely whitelist the header for your API route:

• Action: Connect directly with a Live Agent via chat, email or phone call.

• What to provide:

  1. Your Domain Name and the full API Endpoint URL (e.g., [example.com/api/v1/vehicles](https://example.com/api/v1/vehicles)).

  2. The custom headers or method being sent (e.g., X-API-Key, POST).

  3. The approximate date/time the 403 error started occurring.