Hi everyone, I hope you're all doing well.
I'd like to hear about real experiences with ModSecurity
My setup:
My experience:
I ran this server for long time so far without ModSecurity and all fine but now i wan to try to add more secuirty. A few months ago I enabled it, and since then I keep running into strange issues: admin actions failing, backup plugins (UpdraftPlus) breaking to upaload with on google drive , and odd behavior I couldn't explain at first. Each time I eventually traced it back to ModSecurity. When I disable it, everything works normally again.
I also noticed that LFD has banned IPs that look like normal visitors (for example, Cloudflare WARP addresses) because of ModSecurity hits.
I know there are options to fix this by some of the following:
I know many people just skip ModSecurity to save the headache. I'm trying to understand whether that's the right call, or whether it's worth sticking with it until it's configured properly.
Thanks in advance for sharing your experience!
I'd like to hear about real experiences with ModSecurity
My setup:
- DirectAdmin with CustomBuild, Apache + PHP-FPM, AlmaLinux 9
- ModSecurity with OWASP CRS 4.30, paranoia level 1
- CSF/LFD with LF_MODSEC enabled (auto-blocks IPs that trigger ModSecurity)
- ClamAV scanning uploads through ModSecurity (@inspectFile runav.pl)
- Several WordPress sites, including WooCommerce with Subscriptions and Memberships, behind Cloudflare
My experience:
I ran this server for long time so far without ModSecurity and all fine but now i wan to try to add more secuirty. A few months ago I enabled it, and since then I keep running into strange issues: admin actions failing, backup plugins (UpdraftPlus) breaking to upaload with on google drive , and odd behavior I couldn't explain at first. Each time I eventually traced it back to ModSecurity. When I disable it, everything works normally again.
I also noticed that LFD has banned IPs that look like normal visitors (for example, Cloudflare WARP addresses) because of ModSecurity hits.
I know there are options to fix this by some of the following:
- Rule exclusions by rule ID / URL
- The official CRS WordPress rule exclusions plugin (since CRS 4 moved them out of the core rules)
- Running in DetectionOnly mode
- Disabling LF_MODSEC so LFD doesn't auto-ban
- can u share if you run ModSecurity on your WordPress servers, or did you turn it off?
- If you kept it, was it worth the tuning effort? Did the CRS WordPress exclusion plugin solve most of the false positives?
- If you turned it off, what do you rely on instead (Cloudflare WAF, Wordfence/other security plugin, CSF only, Imunify360, etc.)?
- For WordPress-only servers, which approach has actually worked best for you long term?
I know many people just skip ModSecurity to save the headache. I'm trying to understand whether that's the right call, or whether it's worth sticking with it until it's configured properly.
Thanks in advance for sharing your experience!