# Inline CSS Style Returns 403 Error **URL:** \ **Category:** Using Concrete / Help\ **Created:** [June 10, 2022, 7:44pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247 "2022-06-10T19:44:24Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![GetSirius](https://forums.concretecms.org/user_avatar/forums.concretecms.org/getsirius/32/5810_2.png) [@GetSirius](https://forums.concretecms.org/u/GetSirius)\ **Post date:** [June 10, 2022, 7:44pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/1 "2022-06-10T19:44:24Z")
Hello, I have run into an issue where a 403 error is thrown when a page is edited and includes an inline CSS style such as ## or . These CSS rules were written by concrete, not added manually. 403 error Forbidden The page you were looking for: /concretest856/index.php/ccm/system/dialogs/block/edit/submit?ccm\_token=1654889136:9e921a8e8e94cc7afda9ed2fbebdf3d5&cID=296&arHandle=Main&bID=680 is not a page you are supposed to be looking at! Not sure if this just happened or my client just discovered it. Using Neat theme, with CSS added via concrete, but no code modifications. Tried changing to untouched Elemental theme with same result. Tried downgrading PHP from 7.4 to 7.0 and 5.6, same result. Can anyone help with this issue? thank you, Chuck **Environment Information** # concrete5 Version Core Version - 8.5.6 Version Installed - 8.5.6 Database Version - 20210622145600 # Database Information Version: 5.7.38 SQL Mode: # concrete5 Packages Cloneamental (0.9.3), Neat (0.9.2), oh\_love (1.0.0), Replica Theme (1.1.0), Stucco (2.1.6), Supermint Theme (3.4.1.3) # concrete5 Overrides None # concrete5 Cache Settings Block Cache - Off Overrides Cache - Off Full Page Caching - Off Full Page Cache Lifetime - Every 6 hours (default setting). # Server Software Apache # Server API cgi-fcgi # PHP Version 7.4.29 # PHP Extensions bcmath, bz2, calendar, cgi-fcgi, Core, ctype, curl, date, dom, enchant, exif, fileinfo, filter, ftp, gd, gettext, hash, i360, iconv, imagick, imap, intl, ionCube Loader, json, libxml, mbstring, mysqli, mysqlnd, openssl, pcntl, pcre, PDO, pdo\_mysql, pdo\_pgsql, pgsql, Phar, posix, pspell, readline, Reflection, session, SimpleXML, snmp, soap, sockets, SPL, standard, tidy, tokenizer, xml, xmlreader, xmlrpc, xmlwriter, xsl, zip, zlib # PHP Settings max\_execution\_time - 120 log\_errors\_max\_len - 1024 max\_file\_uploads - 20 max\_input\_nesting\_level - 64 max\_input\_time - 120 max\_input\_vars - 1000 memory\_limit - 128M post\_max\_size - 64M upload\_max\_filesize - 64M ic24.api.max\_timeout - 7 mbstring.regex\_retry\_limit - 1000000 mbstring.regex\_stack\_limit - 100000 mysqli.max\_links - Unlimited mysqli.max\_persistent - Unlimited pcre.backtrack\_limit - 1000000 pcre.recursion\_limit - 100000 pgsql.max\_links - Unlimited pgsql.max\_persistent - Unlimited session.cache\_limiter - _no value_ session.gc\_maxlifetime - 7200 soap.wsdl\_cache\_limit - 5 unserialize\_max\_depth - 4096 ---
**Author:** ![mesuva](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mesuva/32/6303_2.png) [@mesuva](https://forums.concretecms.org/u/mesuva)\ **Post date:** [June 11, 2022, 9:30am UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/2 "2022-06-11T09:30:44Z")
This is likely to be a thing called ‘Mod Security’ on your server, blocking what it detects to be a malicious POST to the server, with it being a false positive. Normally Mod Security just works to block obvious/common hacking attempts, but sometimes it’ll block things that you don’t want it to. It’s not really a Concrete issue. What you would do is contact your host: - trigger the error and take note of when you triggered the block - contact your host, and ask them to check the Mod Security logs around the time you triggered the block. You can also send them through the URL where it’s returning the 403 response. - ask them to whitelist any rules that appear to be triggered Some cPanel setups have a page where you can turn on and off ModSecurity, but it’s better to leave it on and whitelist specific rules. ---
**Author:** ![GetSirius](https://forums.concretecms.org/user_avatar/forums.concretecms.org/getsirius/32/5810_2.png) [@GetSirius](https://forums.concretecms.org/u/GetSirius)\ **Post date:** [June 11, 2022, 5:51pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/3 "2022-06-11T17:51:21Z")
Thank you for the reply. Yes, it is ModSecurity. Unfortunately my web host refuses to whitelist any rules. I am the only person who has this issue? I would think most everyone using an older version of concrete would have the same issue if it is ModSecurity. ---
**Author:** ![GetSirius](https://forums.concretecms.org/user_avatar/forums.concretecms.org/getsirius/32/5810_2.png) [@GetSirius](https://forums.concretecms.org/u/GetSirius)\ **Post date:** [June 11, 2022, 8:28pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/4 "2022-06-11T20:28:57Z")
So I have contacted my web host, they said it is ModSecurity and nothing they are willing to do about it. I just updated to v9.1.1 and still have the same issue. Moved the site to another server (same host company) and have the same issue. I am lost. Can anyone help? ---
**Author:** ![ConcreteOwl](https://forums.concretecms.org/user_avatar/forums.concretecms.org/concreteowl/32/6304_2.png) [@ConcreteOwl](https://forums.concretecms.org/u/ConcreteOwl)\ **Post date:** [June 11, 2022, 8:57pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/5 "2022-06-11T20:57:56Z")
Turn it off in your htaccess file with this code ```auto SecFilterEngine Off SecFilterScanPOST Off ``` ---
**Author:** ![GetSirius](https://forums.concretecms.org/user_avatar/forums.concretecms.org/getsirius/32/5810_2.png) [@GetSirius](https://forums.concretecms.org/u/GetSirius)\ **Post date:** [June 11, 2022, 9:29pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/6 "2022-06-11T21:29:07Z")
Yes, turning off ModSecurity works, but does not seem to me to be the proper fix for this issue. From what I read, that is not the proper thing to do. Is this what everyone has to do these days? ---
**Author:** ![mesuva](https://forums.concretecms.org/user_avatar/forums.concretecms.org/mesuva/32/6303_2.png) [@mesuva](https://forums.concretecms.org/u/mesuva)\ **Post date:** [June 12, 2022, 6:25pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/7 "2022-06-12T18:25:46Z")
Your host is in the wrong here. Every good host I’ve worked with will happily whitelist modsec rules if they can tell it’s false positive. I’d say find a better host, there’s no workaround besides turning it off or whitelisting. ---
**Author:** ![jessicadunbar](https://forums.concretecms.org/user_avatar/forums.concretecms.org/jessicadunbar/32/4320_2.png) [@jessicadunbar](https://forums.concretecms.org/u/jessicadunbar)\ **Post date:** [June 13, 2022, 1:43pm UTC](https://forums.concretecms.org/t/inline-css-style-returns-403-error/3247/8 "2022-06-13T13:43:28Z")
We do have a couple of hosting partners here: [Web Hosting for Concrete CMS](http://concretecms.com/hosting)