I have attempted to write something that will fix the mod_security problem & have a Hack that works. Basically, I just split the $huburl and $url variables (as appropriate) into two parts (one for the protocol & one for the domain/directory) in all of the redirects that include them. Then in all of the called pages I test to see if a whole URL has been sent and if not I recombine the two parts for processing. Splitting the URL's prevents triggering of mod_security and allows me to complete registration from a client with mod_security to a hub with mod_security. Of course I still can't register to any other hub because the call to confirmregistration.php triggers mod_security. In the changed hub siteregistration.php file the script identifies if the client has split the URL and replies in kind. Thus if this were on a server with a mod_security disabled (or just an exception in place) it could accept registration from client sites using both the current and modified client scripts attached. I apologize if the attached scripts are inelegant. The most elegant solution would be to extend or modify moodles required_param() & optional_param() to test if the passed URL is complete or in two parts then recombine them as required. And for moodle redirect() to test for the passing of a non-local URL in the parameters and if so split it into two parameters. Of course this is only a problem when mod_security is active and non-local URL is passed as a variable so I'm not sure if such a low level change is warranted. Regards Michael