ModSecurity Issue feedbac to share expiernce with activation

[taker18]

Hi everyone, I hope you're all doing well.

I'd like to hear about real experiences with ModSecurity

My setup:

• DirectAdmin with CustomBuild, Apache + PHP-FPM, AlmaLinux 9
• ModSecurity with OWASP CRS 4.30, paranoia level 1
• CSF/LFD with LF_MODSEC enabled (auto-blocks IPs that trigger ModSecurity)
• ClamAV scanning uploads through ModSecurity (@inspectFile runav.pl)
• Several WordPress sites, including WooCommerce with Subscriptions and Memberships, behind Cloudflare

My experience:
I ran this server for long time so far without ModSecurity and all fine but now i wan to try to add more secuirty. A few months ago I enabled it, and since then I keep running into strange issues: admin actions failing, backup plugins (UpdraftPlus) breaking to upaload with on google drive , and odd behavior I couldn't explain at first. Each time I eventually traced it back to ModSecurity. When I disable it, everything works normally again.


I also noticed that LFD has banned IPs that look like normal visitors (for example, Cloudflare WARP addresses) because of ModSecurity hits.
I know there are options to fix this by some of the following:

• Rule exclusions by rule ID / URL
• The official CRS WordPress rule exclusions plugin (since CRS 4 moved them out of the core rules)
• Running in DetectionOnly mode
• Disabling LF_MODSEC so LFD doesn't auto-ban

My questions:

1. can u share if you run ModSecurity on your WordPress servers, or did you turn it off?
2. If you kept it, was it worth the tuning effort? Did the CRS WordPress exclusion plugin solve most of the false positives?
3. If you turned it off, what do you rely on instead (Cloudflare WAF, Wordfence/other security plugin, CSF only, Imunify360, etc.)?
4. For WordPress-only servers, which approach has actually worked best for you long term?

I know many people just skip ModSecurity to save the headache. I'm trying to understand whether that's the right call, or whether it's worth sticking with it until it's configured properly.


Thanks in advance for sharing your experience!

 

[adam12]

I run ModSecurity with my own rules. I don't like the distributed rules of others. I don't let anything ban using modsec logs (modsec can manage it's own table of blocked traffic).

There are some security things I do with modsec that I don't this is possible without, so I enable it. But only under my control.

 

[Ohm J]

modsecurity IP blocked are trigger by BFM from directadmin.

you can turnoff by set "brute_force_scan_mod_security_logs"=0
it's trigger the blocked when "ip_brutecount/2"

 

[germanopires]

I use the OWASP rules, but I had to disable a few rules that were generating false positives. If you’d like, I can list which rules you should disable.