Hello,
I am encountering a blockage from the application firewall (ModSecurity) on my hosting, which prevents the use of a native WordPress feature.
Every write request to the /wp-json/wp/v2/blocks route of the WordPress REST API is rejected with an HTTP 403 status code and the following response body in plain text: WAF: Request blocked by ModSecurity. This route is the one for reusable block patterns ("block patterns"), a standard WordPress feature since version 5.0.
The blockage occurs both when calling the API directly and from the WordPress admin interface, logged in with an administrator account. In the latter case, the editor shows: "The update failed. The response is not a valid JSON response." This message is a direct consequence of the blockage: the editor saves by calling this route itself, receives the firewall's text response instead of the expected JSON, and cannot interpret it.
The rule triggers on the presence of an HTML comment (<!-- ... -->) in the request body. However, the serialization format of WordPress blocks is entirely made up of HTML comments. A simple paragraph is stored like this: <!-- wp:paragraph --><p>My text</p><!-- /wp:paragraph -->. Therefore, there is no valid block content that can pass this rule: the blockage makes the feature completely unusable, not just limited.
Can the WAF settings be improved for this managed service?
I have an open ticket CS16582077 with more details, including reproduction steps, but support seems to be ignoring the ticket 
If anyone from the OVH team is reading this ...
