Support

You are confusing two unrelated things.

The SSH2 PHP module has absolutely nothing to do with your problem or its solution. It something only required for connecting to SFTP servers (Secure File Transfer Protocol – it is an SSH extension and has absolutely nothing to do with FTP).

Back to your problem.

The 406 you were getting was because of your FTP server's password. It contained special characters. Your host has the Apache firewall module called ModSecurity2 installed on their server. One of the rules they had added was being triggered by your FTP password and made your web server think that it's under attack by hackers (you!). This makes it reply with HTTP 406 Not Acceptable. 99 out of 100 times we have a client with a 406 the problem is mod_security2 and a complex password.

The "SecFilterEngine Off" line in .htaccess turns mod_security2 off. By doing that you are able to save the configuration which includes the complex password which was triggering the server protection. However this is a Really Bad Idea™ to live in your .htaccess. Once you have configured Akeeba Backup get rid of that line to restore the added protection to your site. When you want to make changes again to your site, add that line back to .htaccess.

Apparently your server's mod_security2 configuration is completely FUBAR. When you click on the "Test FTP connection" the following information is sent to the server (and can potentially trigger mod_security2 protection):

• FTP hostname
• FTP username
• FTP password
• FTP initial directory

The only two things that can possibly trigger a mod_security2 rule are password and initial directory. Apparently your host's mod_security2 configuration forbids anything which looks like a path as a query string parameter.

backup works fine if "SecFilterEngine Off" is included in .htacces, and produces an error in this command is not included in .htaccess.

Now, this makes absolutely no sense. During the backup (NOT the configuration on the backup!!!!!!!) we DO NOT send any information from the browser to the server except the backup start. At this time we send the following information:

• Backup profile number
• Backup description
• Backup comment
• ANGIE password
• JPS password (if you're using JPS archives)

If backing up (not just configuring Akeeba Backup) fails without the "SecFilterEngine Off" line in your .htaccess then something you've put in one of the fields in the Backup Now page is triggering mod_security2.

Where can I start from?

That's the million dollar question :) You can't start from anything, as you do not have control over your mod_security2 configuration (bummer). The only thing you could do, you've already done: ask your host for help. And they gave you the suicidal answer, asking you to disable mod_security2. And let me explain why your host's support is being a bunch of douches.

Your host installed mod_security2 and applied a VERY restrictive configuration (which I'd call "overkill") for security reasons. They are not willing to relax some of its restrictions to let your site run a backup. But they ask you to completely disable the security measures as an alternative, which completely counters the premise of having mod_security2 installed for security reasons! It's absurd. Imagine sitting in someone's car and be obliged to wear a seatbelt for security reasons. The seatbelt is a little high, choking you, so you ask them to please lower it a bit to protect you without choking you. They refuse to do that and ask you to take off the seatbelt. In which possible universe is this responsible security policy?!

Please go back to your host and explain them that they really need to take a look at their mod_security2 rules. If they look at their log they'll find out which rule is preventing your Akeeba Backup configuration from being saved and they can modify it a bit – or remove it. Asking hosting clients to turn off security is not a solution and completely opposes the premise of trying to run a moderately secure server environment.

If I understand you, with SecFilterEngine Off removed from .htaccess, and ftp backup working, I should be safe. Is that correct?

Yes, exactly. You would only need to put this line back if you edit the Configuration of Akeeba Backup or if you try using the Site Transfer Wizard.