---
title: "ModSecurity"
description: "ModSecurity is an open-source web application firewall (WAF) for Apache and Nginx that filters HTTP traffic by rules. Learn how it works and the OWASP CRS."
url: "https://nodea.io/en/glossary/modsecurity"
lang: "en"
updated: "2026-07-13"
---

# ModSecurity

> ModSecurity is an open-source web application firewall (WAF) that filters HTTP traffic at the server level, blocking attacks such as SQL injection and XSS based on rules.

**ModSecurity** is an open-source web application firewall (WAF) that runs as a module of [Apache](https://nodea.io/en/glossary/apache), Nginx or IIS and inspects HTTP traffic on the fly. Using defined rules, it detects and blocks requests that bear the hallmarks of an attack — from code injection to vulnerability scanning — before they reach the application itself.

## How ModSecurity works

ModSecurity embeds itself in the request-processing cycle as an inspection layer between the client and the application. Each incoming request and outgoing response is matched against rules describing patterns of malicious traffic. The key elements:

- **Rules** — expressions that describe what to examine (headers, parameters, request body) and what action to take on a match.
- **OWASP Core Rule Set** — a ready-made, community-maintained [OWASP](https://nodea.io/en/glossary/owasp) rule set that guards against the most common threats.
- **Operating modes** — detection (log only) or blocking (reject requests), with a configurable anomaly-scoring model.
- **Audit logging** — a detailed record of blocked requests that makes incident analysis straightforward.

## ModSecurity in practice

ModSecurity is one of the foundational defence layers on web servers:

1. **Protection against SQL injection and XSS** — it filters attempts at [SQL injection](https://nodea.io/en/glossary/sql-injection) and [XSS](https://nodea.io/en/glossary/xss) scripts before they reach the application.
2. **Virtual patching** — a rule can temporarily block a known vulnerability until a code fix is ready.
3. **Curbing scanning and bots** — blocking automated tools that probe for security holes.

On managed servers, ModSecurity with the OWASP CRS is usually a default part of the configuration, complementing network-level protection with application-layer inspection. The key to effectiveness is tuning the rules to the specific application — an overly aggressive configuration generates false positives and blocks legitimate traffic, which is why deployments usually start in detection mode.

### Does ModSecurity slow a site down?

Every rule is an extra inspection of the request, so some overhead exists, but with a typical configuration it is on the order of single milliseconds. The biggest factor is the size of the rule set and the content-scanning mode; a well-tuned WAF protects an application virtually unnoticed by users.

## Related

- [Firewall](https://nodea.io/en/glossary/firewall)
- [OWASP](https://nodea.io/en/glossary/owasp)
- [SQL injection](https://nodea.io/en/glossary/sql-injection)
- [XSS](https://nodea.io/en/glossary/xss)
- [Apache](https://nodea.io/en/glossary/apache)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/modsecurity.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)