Looking to implement some additional mod_sec rulesets on our server. OWASP and Atomic keep coming up as the best of the best. Would it be wise to implement both? Or, would one or the other be sufficient for PCI compliance?

1 Answer 1


Do not implement both. Is useless. Using the both rule sets is a waste of CPU and memory, because both of them are overlapping.

PCI Compliance require a WAF in some cases, but doesn't specify exactly the functionality. Almost all auditors will look to see if the WAF is protecting you from SQLi, XSS etc. which, in this case, any of the rule sets will do this job.

  • And OWASP or Atomic will not overlap with the base rulesets in place for mod_sec? If this is the case, we will go with one or the other. Thanks for your feedback. Commented Apr 24, 2015 at 10:40
  • Use just one. Don't combine them.
    – Sacx
    Commented Apr 24, 2015 at 10:58
  • Of course, either-or will be used. Never combined. Commented Apr 24, 2015 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .