ModSecurity

ModSecurity is an open-source web application firewall (WAF) that runs as a module of Apache, Nginx or IIS and inspects HTTP traffic on the fly. Using defined rules, it detects and blocks requests that bear the hallmarks of an attack — from code injection to vulnerability scanning — before they reach the application itself.

How ModSecurity works

ModSecurity embeds itself in the request-processing cycle as an inspection layer between the client and the application. Each incoming request and outgoing response is matched against rules describing patterns of malicious traffic. The key elements:

• Rules — expressions that describe what to examine (headers, parameters, request body) and what action to take on a match.
• OWASP Core Rule Set — a ready-made, community-maintained OWASP rule set that guards against the most common threats.
• Operating modes — detection (log only) or blocking (reject requests), with a configurable anomaly-scoring model.
• Audit logging — a detailed record of blocked requests that makes incident analysis straightforward.

ModSecurity in practice

ModSecurity is one of the foundational defence layers on web servers:

1. Protection against SQL injection and XSS — it filters attempts at SQL injection and XSS scripts before they reach the application.
2. Virtual patching — a rule can temporarily block a known vulnerability until a code fix is ready.
3. Curbing scanning and bots — blocking automated tools that probe for security holes.

On managed servers, ModSecurity with the OWASP CRS is usually a default part of the configuration, complementing network-level protection with application-layer inspection. The key to effectiveness is tuning the rules to the specific application — an overly aggressive configuration generates false positives and blocks legitimate traffic, which is why deployments usually start in detection mode.