How do I enable Extra Web Security for my website? - Gregg Hosting

The affects of Web Hosts on Your Business Website

Here're ways your choice of web hosting service provider impacts the performance of your business:


Website loading speed


Uptime and availability


Customer support




Server location

How do I enable Extra Web Security for my website?

How do I enable Extra Web Security for my website?


The Web Application Firewall (WAF) mod security screens and prevents known dangerous HTTP requests. Many, but not all, types of Brute Force, Cross-Site Scripting (XSS), Remote File Inclusion (RFI), Remote Execution, and SQL injection (SQLi) attacks are blocked HTTP requests.

Mod security is enabled by default on GreggHost for free. The ‘Extra Web Security’ option in the panel can be used to enable or disable this capability.

Where to enable this feature?

The panel has two parts to which this can be added:

On the Domains page, click Manage.
When making changes to SSL settings,

Enabling mod_security on the ‘Manage Domains’ page

Go to the Manage Domains section.
Under the Web Hosting column, click the Edit button.
The page Manage Domains appears:
Activate enhanced security.
The checkbox labelled Extra Web Security? is activated by default in the Web Options section.
Uncheck this box and save the modification if you want to disable mod security (s).
Extra Web Security enables you to use a unique security module on your website. This option blocks many common attacks that can damage your website, but it does not guarantee that all attacks will be avoided. GreggHost proactively guarantees that the most commonly known attacks are blocked when Extra Web Security is activated.

mod_security related log entries

The HTTP response code 418 is used by GreggHost. The request was banned by mod security if you have 418 response codes in your access.log files. However, this could indicate that a request to your website was restricted rather than a specific user. To figure out what triggered the 418 error, go through your log entries.

The matching date stamped error.log item often contains further information about the block. Please don’t hesitate to contact support at Contact Support if you’re having problems figuring out why you’re getting a 418 error in your log files.

GreggHost’s mod_security rules

While the majority of GreggHost’s mod security rule set is custom built as threats emerge, the OWASP mod security Core Rules Set is the foundation of GreggHost’s mod security rule set.

‘Unused’ error message

When a user visits your site and receives a 418 error response, the following error message appears:

Unused. The server was unable to finish your request due to an internal problem or misconfiguration.
The 418 error indicates that mod security has imposed a temporary ban on the server. Multiple failed login attempts to a WordPress site are the most common cause of this. After the message has been triggered, all additional attempts to access the login page will result in the message being displayed.

Once this ban has been triggered, GreggHost support is unable to remove it. The user must stop accessing the server for 10 minutes for the ban to be lifted.

If you’re seeing the 418 issue when you’re not logged into your WordPress site, check your error and access logs for 418 response codes, or contact Support.

An important note about modifying .htaccess mod_security rules

At present time, disabling and altering mod security rules via.htaccess is not supported.