Cannot access website hosted in Plesk: the server responded with a status of 403 (ModSecurity Action)

Symptoms

1. After activation of Atomic Professional ModSecurity at Tools & Settings > Web Application Firewall (ModSecurity), some clients cannot access websites:

   Forbidden
   You don't have permission to access /roundcube/index.php on this server.

   Failed to load resource: the server responded with a status of 403 (ModSecurity Action)

2. Error in Chrome or Internet Explorer DeveloperTools:

   HTTP Error 403.0 - ModSecurity Action You do not have permission to view this directory or page

   Failed to load resource: the server responded with a status of 403 (ModSecurity Action)

3. Error in Event Viewer > Windows Logs > Application:

   Message: Access denied with code 403 (phase 1).
   RBL lookup of 2.113.0.203.xbl.spamhaus.org succeeded at REMOTE_ADDR (Illegal 3rd party exploits). [line "51"] [id "350000"] [rev "2"] [severity "ERROR"] Action: Intercepted (phase 1)

4. Unable to issue SSL certificate with the following error in Plesk GUI:

   Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/12345. Details: Type: urn:ietf:params:acme:error:unauthorized Status: 403 Detail: During secondary validation: Invalid response from http://example.com/.well-known/acme-challenge/h9lLrpvgL9gsfgutUgerraF2aOas [203.0.113.2]: “[!DOCTYPE html PUBLIC “-//W3C//DTD XHTML 1.0 Strict//EN” “http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"]rn[html xmlns=“http”

   And the following entry in %plesk_dir%adminlogsphp_error.log:

   Access denied with code 403 (phase 1). RBL lookup of 130.229.222.34.xbl.spamhaus.org succeeded at REMOTE_ADDR (Illegal 3rd party exploits). [file "C:/Program Files (x86)/Plesk/ModSecurity/rules/tortix/modsec/00_asl_rbl.conf"] [line "51"] [id "350000"] [rev "2"] [msg "Global RBL Match: IP is on the xbl.spamhaus.org Blacklist (Report False Positives to www.spamhaus.org)"] [severity "ERROR"]

Cause

ModSecurity blocks access to the website from blacklisted IP address.

Resolution

To disable blocking for particular customer, white list his address.

To disable blocking based on blacklisting for all addresses, disable the rule:

1. Log in to Plesk server via RDP
2. Find ID of the rule that blocks the website in Event Viewer > Windows Logs > Application ().
3. Login to Plesk as admin user
4. Navigate to the tab  Tools & Settings > Web Application Firewall (ModSecurity) > General. 
5. Add the rule ID mentioned in the error message to Security rule IDs field and press OK: