1. Add the Atomic repository
This installer detects your supported Linux distribution and configures the Atomic package repository:
sudo wget -q -O - https://updates.atomicorp.com/installers/atomic | sudo bash
Review scripts before piping them to a shell if that is part of your operating policy.
2. Install the engine
Apache on RHEL, Rocky, AlmaLinux, CentOS, Oracle Linux, or Amazon Linux
sudo yum -y install httpd mod_security
Nginx on an RPM-based distribution
sudo yum -y install nginx nginx-module-modsecurity
Apache on Debian or Ubuntu
sudo apt install libapache2-mod-security2
Package names can differ by OS release. If your distribution package is unavailable, use the Atomic package archive or consult the distribution-specific documentation.
3. Add rules
Install the Atomic Update Manager, configure your free or commercial feed, and fetch the rules:
sudo wget -q -O - https://updates.atomicorp.com/installers/aum | sudo bash
sudo aum configure
sudo aum -u
4. Verify before enforcing
Confirm the module loads, configuration syntax passes, and requests appear in the ModSecurity audit log. Begin with SecRuleEngine DetectionOnly when adding a WAF to an existing application, review real traffic, and then move to On.
Send a quick test request
After the engine is set to On and the Atomic rules are loaded, send this harmless test request to your local web server:
wget -S -O /dev/null 'http://localhost/get_a_waf?done=http://example.com/bad'
The WAF should block the request, normally with an HTTP 403 Forbidden response. In the ModSecurity audit log, the matching event should identify Atomic rule 340162. Seeing both the blocked response and rule 340162 confirms that traffic is reaching the engine, the Atomic rules are loaded, and disruptive actions are enabled.
If the request succeeds—or it is denied without a rule 340162 event—check that SecRuleEngine is On rather than DetectionOnly, confirm the Atomic rules are included, and inspect the web-server error and ModSecurity audit logs.
Production note: A loaded module without current rules is not a complete WAF deployment. Set up rule updates and monitor audit events.