Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be sufficient for PCI compliance?

1 Answer 1


Do not implement both. Is useless. Using the both rule sets is a waste of CPU and memory, because both of them are overlapping.

PCI Compliance require a WAF in some cases, but doesn't specify exactly the functionality. Almost all auditors will look to see if the WAF is protecting you from SQLi, XSS etc. which, in this case, any of the rule sets will do this job.

  • And OWASP or Atomic will not overlap with the base rulesets in place for mod_sec? If this is the case, we will go with one or the other. Thanks for your feedback. Apr 24, 2015 at 10:40
  • Use just one. Don't combine them.
    – Sacx
    Apr 24, 2015 at 10:58
  • Of course, either-or will be used. Never combined. Apr 24, 2015 at 11:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.