Actions say when a rule runs, what metadata it carries, what is logged, how state changes, and what happens when it matches. Actions from the rule and SecDefaultAction are combined, with explicit rule actions overriding applicable defaults.
Disruptive actions
| Action | Effect |
|---|---|
deny | Stops processing and returns the configured error response. |
block | Uses the disruptive behavior defined by the current default action. |
drop | Attempts to terminate the connection without a normal response. |
redirect | Redirects to a supplied URI. |
allow | Allows some or all remaining transaction processing. |
pass | Continues processing; it is not the same as an allowlist decision. |
Disruptive actions do not execute while SecRuleEngine DetectionOnly is active. A rule can still match and log in that mode.
Logging actions
log and nolog control the web-server/error log. auditlog and noauditlog affect the audit log. logdata adds expanded transaction context to the message. Logging attacker-controlled values can expose credentials, tokens, personal data, or control characters.
Required metadata
Every local rule should have a unique id. Use msg for a stable human-readable description, tag for grouping, severity for impact, and rev or ver when managing rule revisions and package identity.
SecRule REQUEST_METHOD "@streq TRACE" \
"id:100040,phase:1,deny,status:405,log,msg:'TRACE method denied',severity:2"
Do not use Atomicorp’s assigned 300000–399999 range for local rule IDs.
Flow and chains
chain makes the next rule another required condition. Put the disruptive action and primary metadata on the chain starter. skip jumps a number of rules; skipAfter continues at a named SecMarker. Flow shortcuts can make policy difficult to reason about, so keep their scope visible.
State actions
setvar creates, updates, increments, decrements, or removes collection members. initcol initializes a persistent collection and expirevar schedules member expiration.
setvar:'tx.score=+5'
setvar:'!tx.temporary_flag'
Runtime control
ctl changes supported settings for the current transaction. Common uses include disabling a rule ID for one narrowly matched context or selecting a request-body processor. Transaction-scoped ctl exclusions differ from configuration-time SecRuleRemove* and SecRuleUpdateTarget* directives.
Sanitization and response actions
Sanitization actions can hide selected arguments, headers, or matched bytes in audit output. Response-altering actions such as append, prepend, and redirect have connector and engine considerations; verify current support before relying on them.