1. Download the IIS installer
Atomicorp publishes pre-built 64-bit ModSecurity installers and checksums in its public binary archive.
Choose the newest supported 64-bit MSI and download its checksum beside it.
Open Windows downloads2. Install the prerequisites and MSI
Install the Microsoft Visual C++ runtime required by the selected build, then run the MSI as an administrator. Installer errors are written to the Windows Application event log under the ModSecurityIIS Installer source.
3. Add a base configuration and rules
Configure modsecurity_iis.conf to include the main ModSecurity configuration and your Windows rule directory:
Include modsecurity.conf
Include windows\*asl*.conf
Do not load multiple copies of the same rules. ModSecurity requires every rule ID to be unique.
4. Test the deployment
Recycle IIS, confirm normal requests work, and check the audit log. Start a new application in DetectionOnly, review events, and enable blocking after validation.
Send a quick test request
After setting SecRuleEngine On and loading the Atomic rules, open PowerShell as an administrator and send this harmless request to IIS:
try {
Invoke-WebRequest -Uri 'http://localhost/get_a_waf?done=http://example.com/bad' -UseBasicParsing
} catch {
"WAF response: $([int]$_.Exception.Response.StatusCode) $($_.Exception.Response.StatusCode)"
}
The expected result is WAF response: 403 Forbidden. The corresponding ModSecurity audit event should identify Atomic rule 340162. Seeing both results confirms IIS is passing requests to ModSecurity, the Atomic rules are loaded, and blocking is enabled.
On current Windows systems, this shorter command is also available:
curl.exe -i "http://localhost/get_a_waf?done=http://example.com/bad"
If the request returns the normal application response—or it is denied without a rule 340162 event—confirm SecRuleEngine On, verify the Atomic rule includes, recycle IIS, and inspect the Windows Application event log and ModSecurity audit log.