When a visitor submits a Contact Form 7 form, the request passes through ModSecurity before reaching WordPress. ModSecurity evaluates the request against a large rule set.
Some rules treat URLs, HTML tags, or long strings as threats. The rule engine flags these patterns even when they belong to a legitimate message. This creates a false positive that stops the form.
If the request body exceeds the configured size limit, ModSecurity stops processing and returns a 403 response. The same occurs when the regular expression engine reaches its match limit while parsing a large message.
Older Core Rule Set versions contain patterns that have been relaxed in newer releases. Shared hosting providers often enable a high‑security profile that blocks any request containing a URL or SQL keyword.
When the visitor’s IP address is not on a whitelist, the profile may reject the POST request regardless of content.