Questions tagged [mod-security]
The mod-security tag has no usage guidance.
17
questions
0
votes
1
answer
77
views
Modsecurity Nginx breaks Wordpress's Woocommerce checkout page. Need help finding working rule exclusions
I am running an Ubuntu 20.04 based LEMP server on a Raspberry Pi 4.
I am working on a Wordpress Woocommerce website at https://www.mcmo.is. Currently on iOS using Safari or Google Chrome, I can't get ...
- 101
1
vote
0
answers
989
views
.htaccess security headers for IONOS
I need to implement security headers for a website hosted by IONOS. I've used the following code, which works on sites hosted elsewhere, but not here.
<IfModule mod_headers.c>
Header set ...
- 119
4
votes
0
answers
221
views
When Bing requests a sitemap or a robots.txt, why do I see Apache reject the 1st request with a 403, followed immediately by a 2nd successful request?
This is a small issue that has been ongoing for quite some time.
When I check my Apache server log for 403's, all entries are related to Bing, and all from when it requests a robots.txt, sitemap.txt, ...
2
votes
1
answer
132
views
Can mod_security run in a “permissive” mode?
SELinux has a "permissive" mode where violations are logged but not enforced, thus allowing for debugging and troubleshooting before locking the system down.
Is there such a feature in ...
- 123
3
votes
1
answer
357
views
cloudflare free vs ModSecurity on Linux shared hosting
On my shared Linux hosting from Hostgator, I had ModSecurity enabled. My website is a Wordpress site, where the Google login redirection URL after successful authentication was being blocked by ...
- 91
0
votes
0
answers
137
views
buckaroo return url flagged by mod_security
Mod security flagged this buckaroo return url as a possible SQL injection attack
Short of excluding /you/pay/buckaroo from mod security rules all together from protections with SecRule ...
- 207
1
vote
1
answer
58
views
Researching .htaccess Syntax
In my template .htaccess file I have been copying and pasteing alot of rules and researching .htaccess for around 2 weeks in an attempt to try and better understand the syntax, different modules & ...
- 68
3
votes
1
answer
2k
views
Request Missing a User Agent Header
I activated ModSecurity on a cheap web hosting but I have no control over it: that is, the only thing the service provider lets you do is reading logs but, unfortunately, you can't really configure ...
user93110
1
vote
1
answer
834
views
how can file content affect whether its uploading gets a 403 error
I use ajax (POST) in javascript to send text data to be saved as a file on the server by a php program (which simply does an fopen, fwrite and fclose). This generally works OK.
However recently I ...
- 131
1
vote
1
answer
1k
views
Handling requests to server's IP address
I have an Apache Web Server running some virtual hosts, site1.com and site2.com.
What do I do with requests to the server's IP address?
Is it safe to allow requests by IP or do I need block, ...
- 119
3
votes
0
answers
283
views
Why am I seeing "*QUERYSTRINGPII_REMOVED*" in the query string of a lot of requests
I regularly see URIs like the following that contain *QUERYSTRINGPII_REMOVED* and the IDS blows them away without further examination. I could just allow the asterisk character but it isn't legitimate ...
- 41
8
votes
0
answers
419
views
Installing Comodo software on an Apache-based Modsecurity module [closed]
I am very new to the VPS world and I want to install Modsecurity on my new VPS (Ubuntu 16, Apache, Webmin) after getting many recommendations to do so (already installed CSF-LFD but had many voices to ...
user58733
6
votes
1
answer
1k
views
Block IP requesting xmlrpc.php
We have a firewall with modsecurity installed. I would like to write a rule to block any IP address for 24 hours if that IP requests xmlrpc.php. Please note that we do not use WordPress on our ...
- 163
1
vote
0
answers
1k
views
rotating mod_security logs with rotatelog
I would like to rotate mod_security logs with rotatelogs, as this does not need a restart of the httpd, like logrotate does. However, it seems like mod_security does not want to work together with ...
- 111
2
votes
2
answers
671
views
Prevent request via IP address of server
I'm pretty sure there's a way to prevent access to a website through the server IP address and to force the user to enter the domain name instead.
so that http://156.56.75.87 should trigger a 403 and ...
- 464
1
vote
2
answers
731
views
Filtering content from response body HTML (mod_security or other WAFs)
We have Apache on Linux with mod_security as the Web App Firewall (WAF) layer. To prevent content injections, we have some rules that basically disable a page containing some text patterns from ...
- 11
1
vote
0
answers
45
views
Regex isn't honored in mod_security2
SecRule REQUEST_URI "^/(|(.*)/)(lpt1|lpt2|lpt3|lpt4)(/|\.|\?|$)" "t:none,t:htmlEntityDecode,t:lowercase,t:removeWhitespace,block,msg:'X',id:'1000'"
SecRule REQUEST_URI "^(.*)//(.*)$" "t:none,t:...
- 11