[mistwang]

Due to the relatively high cost of checking against mod_security rules for each every request, LiteSpeed selectively skips mod_sec for static files. if you check the web site against a dynamic page (PHP page), it should work.