Skip to content
  • Solutions
    By Role
    • For Developers
    • For Content Managers
    • For Agencies
    • For IT Admins
    • For Web Hosters
    • For Developers
    • For Content Managers
    • For Agencies
    • For IT Admins
    • For Web Hosters
    By Infrastructure
    • Overview
    • AWS
    • Microsoft Azure
    • Alibaba Cloud
    • Google Cloud Platform
    • Vultr
    • Overview
    • AWS
    • Microsoft Azure
    • Alibaba Cloud
    • Google Cloud Platform
    • Vultr
    • Digital Ocean
    • Linode
    • Upcloud
    • Oracle
    • OVH
    • Digital Ocean
    • Linode
    • Upcloud
    • Oracle
    • OVH
  • Product
    • Plesk Features
    • Plesk Editions
    • What’s new
    • Pricing
    • Roadmap
    • Lifecycle Policy
    • Extensions Catalogue
  • Pricing
  • Extensions
    Featured Extensions
    • SocialBee
    • WP Toolkit
    • Sitejet Builder for Plesk
    • SEO Toolkit
    • Joomla! Toolkit
    • Premium Email
    • Email Security
    • SocialBee
    • WP Toolkit
    • Sitejet Builder for Plesk
    • SEO Toolkit
    • Joomla! Toolkit
    • Premium Email
    • Email Security
    Bundles and packs:
    • Business and Collaboration Edition
    • WP pack
    • Hosting pack
    • Power pack
    • Language pack
    • Business and Collaboration Edition
    • WP pack
    • Hosting pack
    • Power pack
    • Language pack

    See all Extensions

  • For Partners
    • Plesk Contributor Program
    • Plesk Partner Program
    • Affiliate program
    • Plesk University
  • Help Center
    • Documentation
    • Professional Services
    • Support
    • Contact Us
    • Wiki
    • Forum
  • Plesk 360 login
  • Free Trial
  • Pricing
  • Solutions
    • By Role
      • For Developers
      • For Content Managers
      • For Agencies
      • For IT Admins
      • For Web Hosters
    • By Infrastructure
      • Overview
      • Plesk on Amazon Web Services (AWS & Lightsail)
      • Microsoft Azure
      • Alibaba Cloud
      • Google Cloud Platform
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
      • Oracle
      • OVH
  • Products
  • Pricing
  • Extensions
    • Featured Extensions
      • SocialBee
      • WP Toolkit
      • Sitejet Builder for Plesk
      • SEO Toolkit
      • Joomla! Toolkit
      • Premium Email
      • Email Security
    • Bundles and packs:
      • Business and Collaboration Edition
      • WP pack
      • Hosting pack
      • Power pack
      • Language pack
      • See all Extensions
  • For Partners
    • Plesk Contributor Program
    • Plesk Partner Program
    • Affiliate Program
    • Plesk University
  • Help Center
    • Documentation
    • Professional Services
    • Support
    • Contact Us
    • Wiki
    • Forum
  • Plesk 360 login
  • Free Trial
  • Pricing
  • Solutions
    • By Role
      • For Developers
      • For Content Managers
      • For Agencies
      • For IT Admins
      • For Web Hosters
    • By Infrastructure
      • Overview
      • Plesk on Amazon Web Services (AWS & Lightsail)
      • Microsoft Azure
      • Alibaba Cloud
      • Google Cloud Platform
      • Vultr
      • DigitalOcean
      • Linode
      • UpCloud
      • Oracle
      • OVH
  • Products
  • Pricing
  • Extensions
    • Featured Extensions
      • SocialBee
      • WP Toolkit
      • Sitejet Builder for Plesk
      • SEO Toolkit
      • Joomla! Toolkit
      • Premium Email
      • Email Security
    • Bundles and packs:
      • Business and Collaboration Edition
      • WP pack
      • Hosting pack
      • Power pack
      • Language pack
      • See all Extensions
  • For Partners
    • Plesk Contributor Program
    • Plesk Partner Program
    • Affiliate Program
    • Plesk University
  • Help Center
    • Documentation
    • Professional Services
    • Support
    • Contact Us
    • Wiki
    • Forum
  • Plesk 360 login
  • Free Trial
Plesk 360 login
Free Trial

Knowledge Base

Webmail is not working on a Plesk server when ModSecurity with OWASP or Comodo rule set is enabled: Error when communicating with the server

 
active listemailfeaturesfirewallgo

Symptoms

  • When sending or replying to an email via Roundcube/Horde webmail, the operation is spinning with "Sending message..." or fails with one of the following errors:

    Forbidden
    You don't have permission to access /imp/compose.php on this server


    Error when communicating with the server

  • OWASP or Comodo ModSecurity rule set is selected in Plesk at Tools & Settings > Web Application Firewall (ModSecurity) > Settings.

  • One of the following error messages is logged in /var/log/modsec_audit.log:

    [error] [client 203.0.113.2] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_UNMATCHED_BOUNDARY" required. [file "/etc/httpd/conf.d/mod_security.conf"] [line "70"] [msg "Multipart parser detected a possible unmatched boundary."] ...


    [client 203.0.113.2] ModSecurity: [file "/etc/httpd/conf/modsecurity.d/rules/modsecurity_crs-plesk/modsecurity_crs_41_sql_injection_attacks.conf"] [line "209"] [id "981257"] ..., referer: http://webmail.example.com/imp/dynamic.php?page=mailbox


    [client 203.0.113.2] ModSecurity: Warning. Pattern match ...

Cause

ModSecurity Web Application Firewall is enabled with a strict rule set such as OWASP, Comodo or a custom rule set from Imunify360. These rule sets may block some webmail features.

Resolution

  1. Log in to Plesk.

  2. Go to Tools & Settings > Web Application Firewall (ModSecurity).

  3. Depending on the used webmail and ModSecurity rule-set, apply the required solution:

    Note: If both Roundcube and Horde are affected - apply the required solutions for each webmail.

    For Horde webmail and OWASP rule set

    1. Switch to the Settings tab.

    2. Add the lines below to the Custom directives field:

      <LocationMatch "/horde/imp/compose.php">
      SecRuleRemoveById 981231
      SecRuleRemoveById 958125
      SecRuleRemoveById 950005
      SecRuleRemoveById 959914
      SecRuleRemoveById 981257
      SecRuleRemoveById 981260
      SecRuleRemoveById 48
      SecRuleRemoveById 49
      SecRuleRemoveById 50
      SecRuleRemoveById 51
      SecRuleRemoveById 52
      SecRuleRemoveById 53
      SecRuleRemoveById 54
      SecRuleRemoveById 55
      SecRuleRemoveById 56
      SecRuleRemoveById 57
      SecRuleRemoveById 58
      SecRuleRemoveById 59
      SecRuleRemoveById 60
      SecRuleRemoveById 61
      SecRuleRemoveById 62
      SecRuleRemoveById 63
      SecRuleRemoveById 64
      SecRuleRemoveById 65
      SecRuleRemoveById 66
      SecRuleRemoveById 67
      SecRuleRemoveById 68
      SecRuleRemoveById 69
      SecRuleRemoveById 70
      SecRuleRemoveById 71
      SecRuleRemoveById 72
      SecRuleRemoveById 73
      SecRuleRemoveById 74
      </LocationMatch>
      <LocationMatch "/services/ajax.php/imp">
      SecRuleRemoveById 958291
      SecRuleRemoveById 981257
      SecRuleRemoveById 958291
      SecRuleRemoveById 981245
      SecRuleRemoveById 981173
      SecRuleRemoveById 981246
      SecRuleRemoveById 981243
      SecRuleRemoveById 33350147
      </LocationMatch>

    3. Click Apply.

    For Horde webmail and Comodo rule set

    1. Switch to the General tab.

    2. Find the CWAF tag in the Active list and click on it to disable.

    3. Click Apply.

      Note: If the issue still occurs, apply the resolution from the "For Horde webmail and OWASP ModSecurity rule set" article section as well.

    For Roundcube webmail and OWASP rule set

    1. Switch to the Settings tab.

    2. Add the lines below to the Custom directives field:

      <LocationMatch "/roundcube/">
      SecRuleEngine Off
      </LocationMatch>

    3. Press the Apply button.

    Note: If the issue still occurs, consider to disable the rule from the logs by its ID e.g. "981257" using the next section as an example or by applying this instructions

    For Roundcube webmail and Comodo rule set

    1. Switch to the General tab.

    2. Go to Switch off security rules section and add these IDs each on new line:

      • 212880

      • 217280

      • 212740

    3. Click Apply.

Tweet
Share
Share
Email
0 Shares
Read the full article
Related Posts

How to Host a Go App on Plesk

Read More »

Exploring Plesk’s Added Value Solutions So Far in 2023

Read More »

Unveiling Sitejet Builder: The Perfect Match for Your Effortless Website Creation Needs

Read More »
Knowledge Base

How to change PHP version for webmail in Plesk for Linux?

Read More »

Unable to connect to mailbox on Plesk via IMAP/POP3: “Maximum number of connections from user+IP exceeded” OR “Maximum connection limit reached”

Read More »

Unable to log into webmail under specific user: Response body too large

Read More »

Unable to send emails in Plesk with Imunify360: SMTP Error (-1): Connection to server failed

Read More »

Hosting Wiki

  • Django
  • Content Security Policy ( CSP )
  • Server Redundancy
  • Horde
  • RoundCube
  • QMAIL
  • Sendmail
  • Google Cloud CDN
  • Bare Metal Server
  • PhpMyAdmin
  • phpPgAdmin
  • Oracle VM Server
  • Server Virtualization Software
  • Windows Server
  • Linux
  • PHP
  • MongoDB
  • Plesk
  • Web Server
  • DNS Server
  • Firewall
  • Email Autoresponder
  • Mailing Lists
  • Email Alias
  • Email Virus Protection
  • Email Forwarding
  • Webmail
X-twitter Linkedin Youtube Reddit Github
  • Product
  • Login
  • Pricing
  • Editions
  • For Partners
  • Partner Program
  • Contributor Program
  • Affiliate Program
  • Plesk University
  • Company
  • Blog
  • Careers
  • Events
  • About Plesk
  • Our Brand
  • Resources
  • User and Admin guides
  • Help Center
  • Migrate to Plesk
  • Contact Us
  • Hosting Wiki
  • Forum
  • Legal
  • Legal
  • Privacy Policy
  • Imprint

© 2025 WebPros International GmbH

Part of the WebPros®  Family