Customizer preview hits standard Comodo mod_security rules

I started off discussing this in this thread. But now I have an idea of what’s going on I thought I’d post it separately.

The issue is that the preview doesn’t load in the customizer. You get the customizer panel on the left, but the right-hand-side is a white-screen-of-death. Inspector shows that this is because the request to load the preview is returning a 403 Forbidden status.

It turns out that this is because my (shared) host is using the Comodo mod_security ruleset (presumably: https://waf.comodo.com/) and your POST data submitted when requesting the preview from the customizer is matching a rule which is blocking the preview.

I want to report this for two reasons:

1) You may want to identify the field that’s matching the rule and and change it’s name, or whatever, so that it doesn’t match the rule.
2) You may have – or you may have in future – other people who run into this problem on their host, and need to tell them what’s up.

My host says that false positives on the Comodo rules are “not uncommon” and it seems easy to remove the rules. But if this is happening to other people then you may want to do something about it.

Thanks

Ross