Web Application Firewall (ModSecurity)

Back

The web application firewall (ModSecurity) checks every request to the websites and stops attacks such as SQL injection, cross-site scripting and remote code execution.

Web application firewall mode
Requests are not checked.
Requests are checked and events are logged, but nothing is blocked.
Requests are checked and those that break the rules are blocked (403 Forbidden).
Rule set
Configuration preset
Only the address and the headers of requests are checked: the least load.
Recommended. The request body (forms, uploads) is checked too.
Also the responses are checked (data leaks) and more rules are logged without blocking: more load.

Switch off security rules

Rules that block legitimate requests (false positives) can be switched off for the whole server here, or for one domain on its Web Application Firewall page. The IDs are in the log.

One per line, or a range, e.g. 942100 or 941100-941199.
One per line, e.g. attack-xss.
One per line: the rule's message (regular expression).
ModSecurity directives added after the rule set (e.g. your own SecRule). They are checked before they are applied.

Protects every website from attack tools, aggressive crawlers and addresses that send too many requests. Search engines (Google, Bing…) and monitoring services are never blocked. Each domain can change it on its own Web Application Firewall page.

Attack tools
sqlmap, Nikto, WPScan, Nuclei, masscan and similar tools get 403. Their addresses are banned after 3 attempts.
Aggressive crawlers
SEO and data crawlers that load the server without bringing visitors get 403. Remove a crawler from the list if a customer uses its service (e.g. AhrefsBot for Ahrefs, SemrushBot for Semrush).
Request limit
Counts pages and scripts only, not images, styles or fonts. Above the limit the visitor gets 429 (Too Many Requests). The server's own addresses and the trusted addresses of IP Address Banning are never limited.

Banning (Fail2Ban)

Addresses that keep doing these are banned on the firewall for the ban period of IP Address Banning. There you can change the limits or switch a jail off. IP Address Banning

JailBan afterState

The latest requests the firewall blocked or detected (newest first). A request opens its details: the rules and what they matched.