I run an Apache webserver with lots of PHP-sites of several customers.

I tried install apache-mod_security2 after this (german) tutorial that is using these rulesets: http://www.modsecurity.org/download/modsecurity-core-rules_2.5-1.6.1.tar.gz

but if I enable that, nearly all pages have lots of warnings.

I know, it would be best, to adapt all sites, so no warnings are thrown anymore, but that is just too much work for one admin, so I would like to pull those rules down to only the obvious critical Attacks.

2 Answers 2


I know your pain; unfortunately, there really is not much you can do if you're using the core rule set.

You will need to whitelist rules using SecRuleRemoveById. This can obviously get cumbersome. So, what we do in our infrastructure is note what rules are whitelisted for what CMS and whitelist all those rules based on the CMS' that are being ran on the server.

I've been told that TrustWave has specific rules that apply to specific CMS'.

  • It would be great to get a ruleset that covers most standard-attacks, but at TrustWave one 200$ license must be purchased for each web site domain! I could not afford that for a server with about 500 domains. Are there any other free rulesets?
    – rubo77
    Commented Feb 4, 2013 at 7:44

For Properly Configuring CRS with Mod Security you need to Configure:

  1. Mode of Operation (Traditional vs. Anomaly Scoring)
  2. Setting Anomaly Scoring Severity Levels
  3. Setting Anomaly Scoring Threshold Levels (Blocking)
  4. Enable/Disable Blocking
  5. Choose where to log events (Configuration ModSecurity Log Collecter (Mlogc))


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .