An operator compares each selected variable value with its parameter. Explicit operators begin with @; when omitted, regular-expression behavior is traditionally assumed. Being explicit makes rules easier to review.
Text and pattern matching
| Operator | Use |
|---|---|
@rx | Perl-compatible regular-expression matching. |
@streq | Exact string equality. |
@strmatch | Wildcard-style string matching where supported. |
@contains | Substring matching. |
@containsWord | Word-boundary-aware containment. |
@beginsWith | Prefix comparison. |
@endsWith | Suffix comparison. |
@within | Tests whether input occurs inside the operator parameter. |
@pm | Multi-phrase matching. |
@pmFromFile | Loads phrases from a file. |
Use @streq for exact values instead of a regular expression. Use @pm for many literal phrases. This makes intent clearer and can reduce avoidable regex work.
Numeric comparison
@eq, @gt, @ge, @lt, and @le compare numeric values. Normalize and validate input before treating attacker-controlled strings as numbers.
Network and reputation
@ipMatch compares an address against IPs and CIDRs. File-backed variants load lists from disk. @rbl performs a reputation lookup. DNS-based checks introduce external latency and availability dependencies; use a fast local resolver and understand the selected list’s policy.
Input validation
| Operator | Validates |
|---|---|
@validateByteRange | Allowed bytes. |
@validateUrlEncoding | URL-encoding structure. |
@validateUtf8Encoding | UTF-8 structure. |
@validateDTD | XML against a DTD. |
@validateSchema | XML against a schema. |
Security and file inspection
Depending on build support, operators include @detectSQLi, @detectXSS, @inspectFile, and @fuzzyHash. Their availability can depend on linked libraries, external programs, product features, and engine generation.
Negation and captures
Prefix an operator with ! to match when the operator would not match:
SecRule REQUEST_METHOD "!@within GET POST HEAD" \
"id:100020,phase:1,deny,status:405"
For capturing operators, the capture action stores captured values in TX.0, TX.1, and following members. Captured request data may be sensitive; avoid logging it indiscriminately.