Updated: 22 October 2026 · Applies to: ModSecurity 2.x on a cPanel server
If the WordPress dashboard is slow to load and you see an error like this in the logs:
ModSecurity: Output filter: Response body too large (over limit of 524288, total not specified)
ModSecurity is rejecting the response because it exceeds its memory limit for buffering. Raise two settings to fix it: SecResponseBodyLimit and SecRequestBodyInMemoryLimit.
SecResponseBodyLimit
The maximum response body size ModSecurity will buffer, in bytes. Anything larger gets rejected with a 500 error. Default is 524288 (512KB), with a hard ceiling of 1GB. Does not affect MIME types that are not selected for buffering.
SecResponseBodyLimit LIMIT_IN_BYTES
SecRequestBodyInMemoryLimit
The maximum request body size ModSecurity keeps in memory, in bytes. Default is 131072 (128KB). Once a multipart/form-data request passes this limit, ModSecurity streams the rest to a temporary file on disk instead of memory.
SecRequestBodyInMemoryLimit LIMIT_IN_BYTES
Apply the fix
On a cPanel server, the ModSecurity config file is usually:
/usr/local/apache/conf/modsec2.conf
Open it in a text editor and add, or increase, these two lines:
SecResponseBodyLimit 546870912 SecRequestBodyInMemoryLimit 546870912
Then restart Apache:
service httpd restart
If the dashboard is still slow after this, check the server's own Apache and ModSecurity error logs for a different message; a large response alone does not always explain slowness, and a separate issue (a plugin, a slow database query, or an unrelated server load problem) can produce similar symptoms.
