ModSecurity False Positive (Rule 200002)

@keeleon This is due to a security configuration by your server, we don’t have any control over that within Burst.

I don’t know much about Mod Security, so I’ve checked with AI what possible solutions there are for such an issue. Let me know if this is helpful!

————-

This is a well-known ModSecurity/JSON parsing conflict. The error “Cannot add scalar value without an associated key” means ModSecurity’s request body processor is trying to parse the JSON payload sent by Burst Statistics to /wp-json/burst/v1/track/, but the JSON structure contains array-style or scalar values at the root level that confuse the parser.

The cleanest fix is a targeted rule that overrides the body processor for that specific URI, keeping all other rules intact.

Option 1: Switch the body processor to URLENCODED for that endpoint (recommended)

Add this to your custom ModSecurity rules file (e.g. /etc/modsecurity/custom-rules.conf or inside a .conf file in your modsecurity.d/ directory):

apache

SecRule REQUEST_URI "@beginsWith /wp-json/burst/v1/track" \
    "id:9009001,\
    phase:1,\
    pass,\
    nolog,\
    ctl:requestBodyProcessor=URLENCODED"

This tells ModSecurity to treat the body as plain URL-encoded data instead of trying to parse it as JSON, so no parsing error occurs and the request goes through. All other rules keep running.

Option 2: Disable request body inspection for that URI only

If option 1 doesn’t fully resolve it:

apache

SecRule REQUEST_URI "@beginsWith /wp-json/burst/v1/track" \
    "id:9009001,\
    phase:1,\
    pass,\
    nolog,\
    ctl:requestBodyAccess=Off"

This turns off body inspection entirely for that endpoint. Slightly broader, but still highly targeted since it only applies to that one URI.