A URI fragment is never actually sent to the server by a well-behaved client, it's only meant to be processed client-side, where Apache and ModSecurity can't see it. The fragment identifier functions differently to the rest of the URI: its processing is exclusively client-sided with no participation from the web server, though the server typically helps to ...


Yes, you can remove the argument s from rule 932150 (ctl:ruleRemoveTargetById=932150;ARGS:s) if the string s contains the word ruby (ARGS:s "@contains ruby"): SecRule ARGS:s "@contains ruby" \ "id:10000,t:none,pass,nolog,ctl:ruleRemoveTargetById=932150;ARGS:s"


Based on conversation with OP in the comments following the question, Cloudflare's web application firewall (WAF) may be a solution. See comments for more information as to why OP feels that this problem needs to be addressed, why this problem may be difficult for him to solve on his own using mod_security, and how Cloudflare's WAF may be a more effective ...

Only top voted, non community-wiki answers of a minimum length are eligible