ModSecurity Not Blocking Attacks? Fix It Now

If ModSecurity is installed but attacks are still getting through, the usual causes are a disabled rule set, a permissive SecRuleEngine setting, or rules that are being bypassed by request encoding. This article explains the most common reasons ModSecurity fails to block attacks and provides a step-by-step fix path to get it working properly.

Background: What ModSecurity Does and Why It Sometimes Fails

ModSecurity is an open-source web application firewall (WAF) that inspects HTTP traffic in real time. It works by matching incoming requests against a set of rules that describe known attack patterns—SQL injection, cross-site scripting (XSS), local file inclusion, and others. When a request matches a rule, ModSecurity can block it, log it, or just pass it through, depending on how it is configured.

The most common reason ModSecurity appears to “not work” is that it is running in Detection Only mode. In this mode, it logs violations but never blocks anything. Many default installations start this way so administrators can see what would be blocked before enabling enforcement. If you never switched it to On, your WAF is just a very detailed logger, not a security barrier.

Another frequent cause is that the core rule set (CRS) is not installed or is outdated. ModSecurity itself is just the engine; the rules are what define malicious behavior. Without a current CRS, the engine has nothing to match against, so it lets everything through.

How ModSecurity Rules Work

ModSecurity uses rules written in its own language, often stored in .conf files. Each rule has three main parts: a variable to inspect (like REQUEST_URI or ARGS), an operator (like @rx for regex or @streq for exact string match), and an action (like block, allow, or log).

For example, a simple rule to block requests containing “../” in the URI might look like this:

SecRule REQUEST_URI "@rx \.\./" "id:100001,phase:1,deny,status:403"

Rules are evaluated in phases. Phase 1 runs before request body parsing, Phase 2 after, and so on. If a rule is placed in the wrong phase, it may not see the data it needs. Also, rules are processed in order, so a rule that sets SecRuleEngine to Off or uses a “pass” action can stop subsequent rules from running.

Common Reasons ModSecurity Isn’t Blocking

• SecRuleEngine is set to DetectionOnly — the most common cause; logs but does not block.
• Core Rule Set not installed or outdated — no rules means no detection.
• Rules are bypassed by request encoding — for example, URL-encoded payloads or multipart forms that the rules don’t decode.
• ModSecurity is loaded but not enabled for the virtual host — often a missing “SecRuleEngine On” in the vhost config.
• False negatives due to overly permissive exclusions — rules that whitelist certain paths or parameters can be too broad.
• ModSecurity version too old — older versions lack support for newer attack patterns or have known bypasses.

How to Fix: Step-by-Step

1. Check the current mode. Look for SecRuleEngine in your config. It should be On (not DetectionOnly or Off). If it’s not On, change it and restart your web server.
2. Verify the rule set is loaded. Confirm that the CRS .conf files are included in your ModSecurity config. You can test by sending a request with a known attack payload (like ?id=1' OR '1'='1) and checking the audit log for a match.
3. Update the CRS. Download the latest version from the official OWASP CRS repository and replace old files. Old rules miss new attack vectors.
4. Check the audit log. The default log location is often /var/log/modsec_audit.log. Look for entries with “Action: Intercepted” or “Blocked”. If you see “Action: Logged” only, it’s in detection mode.
5. Test with a known payload. Use a simple SQLi pattern like ?id=1 AND 1=1. If it’s not blocked, your rules aren’t matching or the engine is off.
6. Check for rule exclusions. Some rules have SecRuleRemoveById or SecRuleUpdateTargetById directives that disable specific rules. Review these to ensure they aren’t too broad.
7. Ensure ModSecurity is enabled for the virtual host. If you use Apache, each vhost may need its own SecRuleEngine On directive. For Nginx, check that the modsecurity module is loaded and the config file is referenced.

Bypasses You Should Know About

Even with everything configured correctly, attackers can bypass ModSecurity using encoding tricks. For example, sending a payload as %27%20OR%20%271%27%3D%271 (URL-encoded) might not be decoded by the rules if they inspect the raw URI. The CRS includes decoders, but they are not perfect.

Another common bypass is using chunked transfer encoding for the request body. If ModSecurity doesn’t reassemble chunks before inspection, it sees only pieces. Newer versions handle this, but older ones may not.

Also, multipart form data can confuse rules that look at ARGS, because the payload is split across boundary strings. The CRS has special handling for multipart, but it’s a known weak point.

To mitigate these, keep ModSecurity and the CRS updated, and consider adding your own rules to catch specific bypass patterns you observe in your logs.

Testing Your Configuration

After making changes, you need to test that blocking actually works. Send a harmless but clearly malicious-looking request to your own server, such as:

curl -i "http://yourdomain.com/?id=1' OR '1'='1"

If ModSecurity is working, you should get a 403 Forbidden response. If you get a 200 OK, something is still wrong. Check the audit log to see if the request was evaluated and why it was allowed.

Also test a legitimate request to ensure you haven’t broken normal traffic. The CRS can cause false positives, so you may need to tune exclusions for specific paths that legitimately contain special characters.

Alternatives and Additional Layers

If ModSecurity continues to fail despite correct configuration, consider these alternatives:

• Use a managed WAF — cloud-based services like Cloudflare or AWS WAF handle rule updates and bypasses for you.
• Add a second layer — a reverse proxy with its own filtering (like Nginx + NAXSI) can catch what ModSecurity misses.
• Application-level input validation — the most reliable defense is to validate and sanitize all input in your application code. A WAF is a supplement, not a replacement.

Frequently Asked Questions

Why is ModSecurity logging but not blocking?

This is almost always because SecRuleEngine is set to DetectionOnly. Change it to On in your main config or vhost, then restart the web server.

How do I know if ModSecurity is actually working?

Send a request with a known attack payload and check for a 403 response. Also inspect the audit log for entries with “Blocked” or “Intercepted” actions.

What is the OWASP Core Rule Set?

It’s a set of generic attack detection rules for ModSecurity, maintained by the OWASP foundation. It covers SQLi, XSS, LFI, RCE, and other common attacks. Most installations should use it.

Can ModSecurity be bypassed?

Yes, like any signature-based system, it can be bypassed with encoding tricks or novel attack patterns. Keeping the CRS updated and adding your own rules reduces the risk but doesn’t eliminate it.

Should I use ModSecurity on a high-traffic site?

ModSecurity adds CPU overhead, especially with complex rules. On high-traffic sites, test performance impact and consider using it in a reverse proxy or offloading to a managed WAF.

Why does ModSecurity block legitimate users?

This is usually a false positive from the CRS. You can create exclusions for specific rules or parameters that are safe, but do so carefully to avoid opening holes.

Related

• Read Emails in Message List? A Clear Answer
• Lone Wanderer vs Shared Journey: Social Preference
• Connect to Phone Hisense TV: Full Guide