ModSecurity is an open source web application firewall engine. It observes HTTP requests and responses, exposes their parts to rules, and can log, allow, or block traffic based on those rules.
The three parts of a working deployment
- Engine: ModSecurity 2.x or libmodsecurity 3 performs inspection.
- Connector: Apache, Nginx, or IIS passes web traffic to the engine.
- Rules: Detection logic identifies attacks, abuse, and policy violations.
Installing only the engine is like installing an antivirus scanner without signatures. It may run, but it does not have useful detection policy until rules are loaded.
What it can protect against
A well-maintained rule set can detect common injection, cross-site scripting, traversal, scanner, bot, brute-force, malicious upload, and protocol-evasion techniques. Virtual patches can block an exploit technique at the HTTP layer while an application fix is being deployed.
What it does not replace
ModSecurity does not replace secure application development, authentication, patching, or host security. It is a compensating and defense-in-depth control at the web boundary.