Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm doing a clean install of my server and I'm looking for some advice on whether or not I actually need the Apache mod_security module.

I consider myself to be a bit security paranoid when it comes to my servers, but is it worth going through all the hassle to install and debug a new config of mod_security?

share|improve this question
up vote 5 down vote accepted

If you want to have fine grained manipulation of the interaction between the client and your server, mod_security is the way to go. It's a fine Open Source solution if you want to implement a "Web Application Firewall." (WAF)

If you do not want to spend the time properly configuring it and writing rules suited for your particular applications the benefit will be more limited.

As with other security solutions such as network and host based IDS, WAF are becoming more common. It looks like WAF have the potential to become a standard in the industry. Nevertheless, as with IDS, mod_security is only as good as the person responsible for it is willing to make it.

If you had an application you did not develop and were particularly concerned about, you could limit the potential risk via mod_security without modifying the application.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.