Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a question regarding mod_security. I have installed mod_security on my server and OWASP core rule set. However, now people are having trouble when accessing my page.

For example, one problem is that images are not displayed because they're raising a mod_security patterns. So my question is, Can I somehow disable mod_security patterns for file names?

share|improve this question
What rules are being matched? Can you share the logs? What rules have you activated in your httpd.conf? – Mark Hillick Jul 25 '12 at 14:42

As Mark Hillick said, we'd have to see the mod_security audit logs to answer this. The logs will show just which OWASP rules are being matched. You could then read the documentation for the rule(s) here. Or you could post a couple of examples of the logs here, showing the specific matches. Then we could better help sort this out with you.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.