Operator reference

ModSecurity operators

Reference string, regular-expression, numeric, network, validation, lookup, and inspection operators.

Adapted ModSecurity documentationThis page has been reorganized, rewritten, and supplemented by Atomicorp from upstream ModSecurity reference material. Source, license, and attribution details.

An operator compares each selected variable value with its parameter. Explicit operators begin with @; when omitted, regular-expression behavior is traditionally assumed. Being explicit makes rules easier to review.

Text and pattern matching

OperatorUse
@rxPerl-compatible regular-expression matching.
@streqExact string equality.
@strmatchWildcard-style string matching where supported.
@containsSubstring matching.
@containsWordWord-boundary-aware containment.
@beginsWithPrefix comparison.
@endsWithSuffix comparison.
@withinTests whether input occurs inside the operator parameter.
@pmMulti-phrase matching.
@pmFromFileLoads phrases from a file.

Use @streq for exact values instead of a regular expression. Use @pm for many literal phrases. This makes intent clearer and can reduce avoidable regex work.

Numeric comparison

@eq, @gt, @ge, @lt, and @le compare numeric values. Normalize and validate input before treating attacker-controlled strings as numbers.

Network and reputation

@ipMatch compares an address against IPs and CIDRs. File-backed variants load lists from disk. @rbl performs a reputation lookup. DNS-based checks introduce external latency and availability dependencies; use a fast local resolver and understand the selected list’s policy.

Input validation

OperatorValidates
@validateByteRangeAllowed bytes.
@validateUrlEncodingURL-encoding structure.
@validateUtf8EncodingUTF-8 structure.
@validateDTDXML against a DTD.
@validateSchemaXML against a schema.

Security and file inspection

Depending on build support, operators include @detectSQLi, @detectXSS, @inspectFile, and @fuzzyHash. Their availability can depend on linked libraries, external programs, product features, and engine generation.

Negation and captures

Prefix an operator with ! to match when the operator would not match:

SecRule REQUEST_METHOD "!@within GET POST HEAD" \
  "id:100020,phase:1,deny,status:405"

For capturing operators, the capture action stores captured values in TX.0, TX.1, and following members. Captured request data may be sensitive; avoid logging it indiscriminately.

See the exhaustive upstream operator reference.