Category "mod-security"

Remove target from CRS rule based on multiple criteria

I have a WordPress site. The WP site is running behind a reverse proxy (Apache 2.4.37) with ModSecurity 2.9.7, and the OWASP Core Ruleset 3.1.0. The WP site has

ModSecurity Nginx Custom Forbidden Page + Log ID

We are running the latest Nginx and Modsecurity, everything is working as expected, but we would like to be able to have a custom forbidden page (not the defaul

Cannot resolve Request Header Issue in ModSecurity and its affects on WordPress

CURRENT: I have the familiar issue with an internal 403 coming up... however, after exploring for the issue through all error logs, I have found that the Forbid

How do I create a rule to block all user agents with ModSecurity V3?

I want to add a custom ModSecurity (V3) rule that can block all user agents, and allow me to whitelist certain User Agents from a file. If this is possible, if

How to only allow certain user agents through mod security's WAF?

I'm very new to all of this so I'm kinda stuck... How would I restrict access to my server to a limited amount of user agents (using mod security)? Also how wou

Ubuntu 'Failed to restart apache2.service: Unit apache2.service not found.'

I am using Google Cloud Platform to test out ModSecurity and I am using a tutorial to launch it. However, I need to restart Apache every once in a while. I'm us

Modsecurity & Apache: How to limit access rate by header?

I have both Apache and Modsecurity working together. I'm trying to limit hit rate by request's header (like "facebookexternalhit"). And then return a friendly "