Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We're using mod_security and we have currently issues with some bots.

I would like to block IP Address that visited 404 pages more than 10 times in a minute.

How can this be done? How can I poll the 404 return codes?

How can I count the error 404 return codes in phase 3?

RESPONSE_STATUS may not work as expected in embedded mode, as Apache sometimes handles certain requests differently, and without invoking ModSecurity (all other modules).

How can I get the RESPONSE_STATUS every time for sure? phase 5?

share|improve this question
up vote 2 down vote accepted

Mod_security should already come with some scripts, provided by the OWASP project, which block robots. Have you checked them out? You will have to enable modsecurity_crs_35_bad_robots.conf. You can download the file from the OWASP project site:

Instructions can be found there as well.


== base_rules/modsecurity_crs_35_bad_robots.conf ==  Detection of Malicious Robots
    - Unique request attributes: User-Agent header, URL, Headers
    - RBL Check of IP addresses
    - Detection of security scanners
    - Blocking can confuse security testing software (WAFW00f)
share|improve this answer
thank you, we're already using crs. the problem is, that the bots are visiting from different IPs at 10 req/sec and cause a lot of error 404. how can i count the error 404 return codes in phase 3? – JMW Mar 30 '12 at 7:07
thanks for answering. your answer didn't solve my problem, but since you were the only one that answered, i'll accept it. :-) – JMW May 11 '12 at 8:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.