Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can I find out if mod_security is installed on my apache server? I would also like to learn its version.

I'm having some upload issues and I tried to disable mod_security using .htaccess. But that started producing 500 internal server errors.

I read somewhere that depending on my mod_security version I might not be able to disable it using .htaccess. So I would like to understand if I have mod_security installed and what version it is.

I'm on a centos 5 box.


UPDATE -1 xxxxxxxxxxxxx

Does the below output mean I do not have mod_security installed?

[root@u11 htdocs]# httpd -l

Compiled in modules:
share|improve this question

migrated from Feb 25 '10 at 9:26

This question came from our site for professional and enthusiast programmers.

up vote 4 down vote accepted

No - the output listed above just describes the pre-compiled in modules.

The presence of the mod_so.c entry however means that Apache is capable of dynamically loading additional modules.

If you have access to the central configuration you could just go look at this and check to see if there's a line like:

LoadModule security_module modules/

If there is then you have mod_security loaded - NOTE: this could be within an included configuration file as well.

Assuming your configuration is located in /etc/httpd - you could run the following to find if the config is present:

grep -ir security_module /etc/httpd

(Replace /etc/httpd with the central configuration directory).

If you don't have access to the server config you could use an <IfModule mod_security.c> statement within your .htaccess to see if it's enabled:

<IfModule mod_security.c>

... Perform some kind of redirect or re-writing in here ...


Hope this helps.

share|improve this answer

In some environments mod_security is not required because firewall policy is implemented via hardware; using Debian you should find information about this module typing

grep -ir security_module /etc/apache2/mods-enabled/mod-security.conf

If this file is not present, could be NOT included by hosting provider so check situation also with them.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.