Gery W
Quick update: We've likely found the cause.
It seems the form was sending the dashboard URL as a hidden field during connection. A full URL in a form field can trigger mod_security—probably why you got the 406 error. That field was unnecessary anyway since the address is fixed, so we removed it completely.
Please update to HTProtect 2.5.1 (Joomla → System → Update, and clear the update cache if needed) and try connecting again. It should work now without needing to whitelist anything in mod_security.
If it still doesn’t work, just let us know—then it’s probably another rule and we’ll take another close look.
Thanks for reporting this!