ModSecurity evaluates HTTP transactions using configuration directives and SecRule statements. Start with the overview, then open the part of the language you need.
Version matters: ModSecurity 2.x and libmodsecurity 3 share most rule-language concepts, but directives and connector behavior are not identical. Each deployment guide should be checked against your engine and connector version.
Core ModSecurity configuration
Understand engine mode, request and response body inspection, limits, audit logging, and a safe rollout sequence.
Read guide →Rule languageModSecurity rule language
Learn SecRule anatomy, variables, operators, transformations, actions, chains, phases, and macro expansion.
Read guide →OperationsModSecurity logging and troubleshooting
Read audit events, identify a rule match, distinguish detection from disruption, and troubleshoot safely.
Read guide →Directive referenceModSecurity configuration directives
A practical reference to engine, body inspection, limits, audit logging, uploads, remote rules, and rule-management directives.
Read guide →Variable referenceModSecurity variables and collections
Reference request, response, connection, rule, transaction, persistent, and file variables used by SecRule.
Read guide →Operator referenceModSecurity operators
Reference string, regular-expression, numeric, network, validation, lookup, and inspection operators.
Read guide →Transformation referenceModSecurity transformations
Normalize encoded and evasive input before matching while preserving the original transaction data.
Read guide →Action referenceModSecurity actions and rule flow
Reference disruptive, logging, metadata, flow, control, and state actions used by SecRule.
Read guide →TuningRule exclusions and safe tuning
Fix false positives with narrow target exclusions, transaction controls, and maintainable local configuration.
Read guide →