A blocked web request can sometimes appear as a 403 error, but not every 403 is caused by ModSecurity.
- Confirm the URL and filesystem permissions are correct.
- Check whether a custom
.htaccessrule is denying access. - If the failure is reproducible and ModSecurity controls are available, temporarily disable ModSecurity for the affected domain.
- Repeat the exact request.
- Re-enable ModSecurity after the test.
If disabling ModSecurity makes no difference, continue investigating the other causes rather than leaving security protection disabled.