https://modsecurity.org/docs/index.htmlModSecurity is an open source, cross-platform web application firewall (WAF) engine, donated to OWASP in 2024. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. Securing tens of millions of domains, ModSecurity is the most widely deployed WAF engine in existence. Two engine generations are maintained: ModSecurity v2 (current release 2.9.15) — the classic Apache module (mod_security2), also packaged for IIS. libModSecurity v3 (current release 3.0.17) — a standalone library used through connectors for NGINX and Apache. Warning This site was migrated from the former GitHub wiki, which is partially outdated. Entries in the reference manual carry version badges for v2 and v3; text still marked for review is being updated against the source code.Hugoen-UShttps://modsecurity.org/docs/1-introduction/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/1-introduction/index.htmlModSecurity is an open source web application firewall (WAF). A WAF adds an external security layer in front of web applications to detect and, if configured to do so, prevent attacks before they reach the application. ModSecurity provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis with little or no changes to existing infrastructure. ModSecurity v2 and libModSecurity v3 ModSecurity is developed as two code lines. Both are maintained by the OWASP ModSecurity project (stewardship was transferred from Trustwave to OWASP in 2024) and both implement the same rule language, so rule sets such as the OWASP CRS run on either.https://modsecurity.org/docs/2-installation/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/2-installation/index.htmlHow to build and install libModSecurity v3 with its connectors, and ModSecurity v2 for Apache and IIS.https://modsecurity.org/docs/3-reference-manual/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/3-reference-manual/index.htmlThe rule language and configuration reference for ModSecurity v2 and libModSecurity v3. Each directive, variable, transformation, action and operator is documented once. The metadata table under each entry shows the ModSecurity v2 version it first appeared in, and whether libModSecurity v3 supports it. Badge legend: Badge Meaning since 2.7.0 available from that release on supported available, first release not recorded not implemented yet accepted by the parser or planned, but not functional in libModSecurity v3 not supported not available in that engine unknown not verified yethttps://modsecurity.org/docs/4-logging/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/4-logging/index.htmlThe purpose of this document is to describe the formats of the ModSecurity alert messages, transaction logs and communication protocols, which would not only allow for a better understanding what ModSecurity does but also for an easy integration with third-party tools and products. Alerts As part of its operations ModSecurity will emit alerts, which are either warnings (non-fatal) or errors (fatal, usually leading to the interception of the transaction in question). Below is an example of a ModSecurity alert entry:https://modsecurity.org/docs/5-troubleshooting/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/5-troubleshooting/index.htmlDebugging crashes and misbehavior with gdb, and diagnosing the IIS installer.https://modsecurity.org/docs/6-migration/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/6-migration/index.htmlMoving rules and configuration between ModSecurity generations.https://modsecurity.org/docs/7-development/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/7-development/index.htmlContributing to ModSecurity, the roadmap, and related tools.https://modsecurity.org/docs/8-archive/index.htmlMon, 01 Jan 0001 00:00:00 +0000https://modsecurity.org/docs/8-archive/index.htmlHistorical pages kept for reference. Their content is not maintained.