I'm looking for practical advice on the OWASP rule set for mod_security. I've heard it has many false positives, and wondering if people have successfully applied it?

I can't afford the TrustWave and my first few interactions with Atomicorps GotRoot rules has not been positive so I'm exiting my options.

Are there any other rule set providers?

  • Have you tried the Comodo rule set? An alternative approach would be to use Cloudflare's security, there is a free version which is pretty good. Mar 23, 2015 at 20:06
  • Looks awesome! Had not heard of that. Cheers. Have you experience with them compared to other rule sets? Mar 23, 2015 at 20:09
  • Sorry, I've only dealt with them in the past from some other of their products. They were OK to deal with. Did you see my updated comment re Cloudflare? Mar 23, 2015 at 20:11
  • Yeah I did (re cloudflare) I have thought about it, but when I trailed it, my DNS was having some issues working properly and the caching they use also messed with some code i was running Mar 23, 2015 at 20:13
  • Yes, you do need to be a bit conservative about the code caching. However, the security features are excellent. Just turn off the code caching if you don't want it. Use them & mod_security if you want! Mar 23, 2015 at 20:15

1 Answer 1


Though I've not used them myself, another ruleset is produced by Comodo. I've used a number of their products over the years and they seem OK to deal with.

In addition, you can use the free tier of Cloudflare to add security to your website. I've been using it on both my main sites since they introduced the new facilities towards the backend of last year and it seems pretty good. My sites are faster, I get some analytics and they have blocked a number of potential attacks. Their are paid tiers that give you more control as well. You could use both if you wanted to.

  • I noticed the other day actually, that stack overflow (and its sister sites obviously) are running through CloudFlare. Mar 23, 2015 at 20:36
  • Yes, many big sites use them to offload a lot of caching. Mar 23, 2015 at 20:37
  • Looking over Cloudflare, the WAF was not included in the free plan and $20 a month didn't seem to stack up against Atomicorps $99 / year. Mar 23, 2015 at 23:00
  • I don't think you necessarily need the paid tier, you still get standard protection with the free tier. Combine with mod_security and one of the free rulesets & you have a decent level of protection. Or even just some basic IPTABLES rules and perhaps fail2ban. Mar 24, 2015 at 0:01
  • Strange that OWASP is not included in CloudFlare's Free plan, seeing as OWASP is free! Not overly convinced of the free offerings tbh - seems more trouble than it's worth. And $20 per month + $5 a site per month is just way over the top... Does anyone have experience with CloudFlare free? Mar 24, 2015 at 18:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .