https://modsecurity.org/docs/2-installation/index.htmlHow to build and install libModSecurity v3 with its connectors, and ModSecurity v2 for Apache and IIS.Hugoen-UShttps://modsecurity.org/docs/2-installation/2-1-building-libmodsecurity/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-1-building-libmodsecurity/index.htmllibModSecurity is a C++17 library. On Unix-like systems it is built with autotools; Windows builds use CMake and Conan and are described in the Windows build README. The library does nothing on its own: after installing it, add a connector for your web server, see libModSecurity v3 with NGINX and libModSecurity v3 with Apache. If you only need a working installation, your distribution most likely packages the library and the NGINX connector already; see Distribution packages for libModSecurity v3. Build from source when you need the current release before your distribution ships it, a build option the package does not enable (LMDB, Lua, ssdeep), or the development branch.https://modsecurity.org/docs/2-installation/2-2-libmodsecurity-v3-nginx/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-2-libmodsecurity-v3-nginx/index.htmlThe ModSecurity-nginx connector links libModSecurity into NGINX as a third-party module. Unlike the old (v2-era) standalone module, it is a thin layer between NGINX and the library: the rules engine, the body processors and the logging all live in libModSecurity. The current connector release is v1.0.4. Distribution packages Most distributions ship the connector as a dynamic NGINX module built against their own nginx and libmodsecurity packages, which is the easiest way to get a working setup. Versions as of October 2026:https://modsecurity.org/docs/2-installation/2-3-libmodsecurity-v3-apache/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-3-libmodsecurity-v3-apache/index.htmlThe ModSecurity-apache connector loads libModSecurity into Apache HTTP Server as the module mod_security3. Warning The Apache connector is not production ready. Its only release is v0.0.9-beta1 from December 2017, the master branch has not changed since 2021, request body handling is incomplete, and no distribution packages it. For Apache, use ModSecurity v2 (mod_security2), which is the maintained and recommended engine on that platform. Compilation Install libModSecurity first (see Building libModSecurity v3 from source), make sure apxs from the Apache development package is on the path, then:https://modsecurity.org/docs/2-installation/2-4-distribution-recipes/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-4-distribution-recipes/index.htmlEvery major distribution packages libModSecurity, and most also package the NGINX connector built against it. The packaged versions lag behind the upstream release, sometimes by several minor versions, but the distributions backport security fixes to the version they ship. Versions in the package repositories as of October 2026: Distribution Library package Version NGINX connector package Version Debian 12 (bookworm) libmodsecurity3 3.0.9 libnginx-mod-http-modsecurity 1.0.3 Debian 13 (trixie) libmodsecurity3t64 3.0.14 libnginx-mod-http-modsecurity 1.0.3 Ubuntu 22.04 LTS libmodsecurity3 3.0.6 none Ubuntu 24.04 LTS libmodsecurity3 3.0.12 libnginx-mod-http-modsecurity 1.0.3 Ubuntu 26.04 LTS libmodsecurity3t64 3.0.14 libnginx-mod-http-modsecurity 1.0.3 RHEL 8 family (EPEL 8) libmodsecurity 3.0.15 none RHEL 9 family (EPEL 9) libmodsecurity 3.0.17 nginx-mod-modsecurity 1.0.4 Fedora 43 libmodsecurity 3.0.16 nginx-mod-modsecurity 1.0.4 Fedora 44 libmodsecurity 3.0.17 nginx-mod-modsecurity 1.0.4 openSUSE Leap 15.6 libmodsecurity3 (source modsecurity) 3.0.10 none openSUSE Tumbleweed libmodsecurity3 (source modsecurity) 3.0.15 none Arch Linux libmodsecurity 3.0.17 nginx-mod-modsecurity 1.0.4 Gentoo dev-libs/modsecurity 3.0.16 www-nginx/ngx-modsecurity 1.0.4 FreeBSD ports security/modsecurity3 3.0.17 security/modsecurity3-nginx 1.0.4 macOS (Homebrew) modsecurity 3.0.17 none The development headers are in libmodsecurity-dev (Debian, Ubuntu) or libmodsecurity-devel (Fedora, EPEL, openSUSE); install them when you build a connector yourself. The OWASP CRS rule set is packaged as modsecurity-crs on Debian and Ubuntu and mod_security_crs on Fedora and EPEL. Alpine Linux and Amazon Linux 2023 do not package libModSecurity; use the container images or build from source there.https://modsecurity.org/docs/2-installation/2-5-modsecurity-v2-apache/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-5-modsecurity-v2-apache/index.htmlModSecurity v2 is an Apache httpd module (mod_security2). The current release is v2.9.15. You can install it from your distribution’s package repository, which is the quickest route and gets you security updates through the normal package channels, or build it from source to get the latest release. Prerequisites Apache httpd 2.x ModSecurity 2.x works with Apache httpd 2.0.x or later (2.4.x is the version in common use today). To build from source you need the Apache development files (the apxs tool and headers), which distributions package as httpd-devel or apache2-dev.https://modsecurity.org/docs/2-installation/2-6-modsecurity-v2-iis/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-6-modsecurity-v2-iis/index.htmlModSecurity for IIS (ModSecurityIIS.dll) is an IIS native module built from the ModSecurity v2 source tree (v2/master, directory iis/). It shares the engine, the rule language and the configuration file format with the Apache module; only the way the module is loaded and configured differs. Prerequisites Windows Server with IIS 7 or later. The Microsoft Visual C++ Redistributable matching the compiler the module was built with (the build scripts in the repository use Visual Studio 2019). Install the 32-bit or 64-bit version according to the application pool architecture. The dependency DLLs that ship alongside the module: APR and APR-util, PCRE, libxml2, Lua, libcurl, YAJL, zlib and libfuzzy. The build scripts produce them together with ModSecurityIIS.dll and mlogc.exe. Obtaining the Module The project publishes source releases only (https://github.com/owasp-modsecurity/ModSecurity/releases); no Windows binaries or MSI installers are attached to current releases. To build the module and, optionally, the MSI installer, use the scripts in the iis/ directory of the v2 tree (build_release.bat builds the dependencies and the module for x86 and amd64, build_msi.bat builds the WiX installer). The general Windows build notes are in README_WINDOWS.md.https://modsecurity.org/docs/2-installation/2-7-package-generation/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/2-7-package-generation/index.htmlDistribution packages lag behind upstream releases, so it is common to need a package of a newer ModSecurity version, or one built with different options, for a distribution that does not ship it yet. The quickest way to get one is to rebuild the distribution’s own packaging against the newer source tarball rather than writing a spec or debian/ directory from scratch: the packaging already carries the configuration layout, the module loading snippets and the dependencies the distribution expects.