LSF does not replace WHM → ModSecurity Vendors (OWASP CRS / Atomicorp). It loads a supplementary ruleset into modsec2.user.conf with apachectl configtest and automatic rollback on failure.
Unload from the WAF tab or lsf --waf-unload. Disable one rule globally or per domain: Rule ID + Disable, or lsf --waf-disable ID [domain]. If the IP was also firewall-banned, Remove it on Overview. WAF bans use a stricter separate threshold (default 2× LF_TRIGGER).
