ModSecurity blocked access due to the following:

[msg "XSS Filter - Category 3: Javascript URI Vector"] [data "Matched Data: esrco found within ARGS:as_email:[email protected]"] [severity "CRITICAL"]

Why does the string esrco trigger an error? I tried googling any javascript implications and could not find any. Should I disable this rule?

  • Are you sure it's the string "esrco" itself which is triggering this?
    – forest
    Jun 15, 2018 at 3:12
  • I copied and pasted the exact error message that I was getting in the log.
    – Mocking
    Jun 15, 2018 at 19:27
  • Potentially helpful: stackoverflow.com/a/34027786/1060378
    – schroeder
    Jul 19, 2018 at 7:27

1 Answer 1


It is the 'src' in esrco that triggers the rule.

I had to deactivate that rule, because it was impossible to forbid the string src across the whole application.

  • 1
    I had to look for a while to find out that you were correct (because the message seemed to contradict you). Next time, please include some source our backup to any claims. I have added the source to your answer.
    – schroeder
    Jul 19, 2018 at 7:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .