I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all?
What would be the recommended packages to use? I want to mostly block bad UA, SQL and XSS attacks.
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.
I went through adding the rules from the Core Rule Set in one at a time and watching closely for false positives. Plenty of the SQL and XSS rules cause false positives, depending on what your URLs look like.
As for slowing down the page loads, the audit log has timing information but I've not yet seen a whole millisecond caused by mod_security. I wouldn't worry too much about that.
As John said, both of these result may be different on your systems with your website.