ModSecurity Documentation

ModSecurity is an open source, cross-platform web application firewall (WAF) engine, donated to OWASP in 2024. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. Securing tens of millions of domains, ModSecurity is the most widely deployed WAF engine in existence.

Two engine generations are maintained:

  • ModSecurity v2 (current release 2.9.15) — the classic Apache module (mod_security2), also packaged for IIS.
  • libModSecurity v3 (current release 3.0.17) — a standalone library used through connectors for NGINX and Apache.
Warning

This site was migrated from the former GitHub wiki, which is partially outdated. Entries in the reference manual carry version badges for v2 and v3; text still marked for review is being updated against the source code.