Enabling ModSecurity (Updated)
For years, I’ve not used ModSecurity for any of my own sites. Way back when I first tried ModSecurity, there were just too many false positives, so I stayed away from it, opting instead to develop my own fast Apache/.htaccess firewall. But my web host now is telling me that ModSecurity is required on all of their managed VPS plans.
I would have left and moved my sites to another web host, but after some thought realized that it would take less time (hopefully) to enable and test ModSecurity than it would to relocate all of my sites to a new server. So, finally pulled the trigger and enabled ModSecurity on most of my sites. This article is simply a summary of the experience, and will be updated with any found bugs or false positives, etc.
Enabling ModSecurity
My web host provides Plesk as the server control panel, which makes it simple to enable (or disable) ModSecurity as needed. After checking the box and choosing some basic options, I mindfully clicked the “save changes” button and immediately went to check all of my domains..
All smooth so far..
After some time checking my sites, everything seems to be running smoothly. No problems so far, will keep my eye on it and report back with any issues.
Update 6 months later
Very happy to report that everything continues going smoothly with ModSecurity. I actively inspect the site’s access and error logs to keep a close eye on traffic. Turns out that ModSecurity is indeed blocking some bad requests, and working great together with 7G Firewall with no false positives or other issues.
Update another 3 months later
Still going good no issues or false positives after almost a year of enabling ModSecurity. And here I thought this was going to be interesting, lol.
3 responses to “Enabling ModSecurity (Updated)”
I am currently on super shared hosting. The hosting has been running for a year without any issues and works great with firewall from hosting + Cloudflare + ModSecurity + 7G Firewall. Thank you for 7G Firewall
The firewall from my hosting shows me blocked attacks from time to time, but most cut out ModSecurity and it complements 7G Firewall very well.
On Debian repositories (at least with Debian “Buster” and so on),
Seems “Mod Security” is being (or has been) replaced with “Mod Security2”. Though I suspect that the older directives used with it should still work, I am mindful of possible changes needed for some of the directives to work in the newer version?
On another topic:
I shortened a bit of htaccess firewall “wizardry” where it came to limiting which files can be accessed. Rather than a long list “no’s”, I chose to use a shorter list of “yes’s” instead.
Something like:
Makes it much simpler to control what file-types can be accessed, and what can added or removed from the filtering. – Possible change in your “next-generation” htaccess-firewall, perhaps?
Yes I suspect they won’t overhaul and reinvent the wheel for ModSecurity 2. Wise to be mindful though, keep an eye on it.
I like the idea of maybe adding some whitelist rules for 7G or maybe 8G. Thanks for the idea :)