Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have mod security installed on my server. It is working for all IP addresses.

Now I need to EXCLUDE specific IP addresses from applying this mod-security. How can I do so? Is there a way to control it using apache?

share|improve this question
up vote 3 down vote accepted

Here the article. The first one is IP based too. what luck.

Excerpt from that page.

Disabling mod_security conditionally per IP ^

This will make sure that you aren't processed by mod_security, but this only works if you have a static IP (Get your IP information). Just add this towards the top of your .htaccess file. before your mod_security code. Setting this variable causes the module to be disabled for this specific IP address, this means you won't run into any problems while posting yourself..

SetEnvIfNoCase Remote_Addr ^$ MODSEC_ENABLE=Off

# You can use multiple SetEnvIf directives to control it further.
# This only turns it off for your IP + a POST request method.
# SetEnvIf Remote_Addr ^$ MODSEC_ENABLE=Off
# SetEnvIf Request_Method !^POST$ MODSEC_ENABLE=On
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.