Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to dis-able mod-security for all websites? except one? i have more than 500 websites hosted, only want to turn it on for one website, which is having attacks on it.

share|improve this question
up vote 8 down vote accepted

Well I suppose it is possible if you enable the configuration for mod security either in .htaccess or in the virtual host apache configuration for that particular domain using something like this :

<IfModule mod_security2.c>
    SecRuleEngine On
    ...... (any other directives you might want to override from the defaul conf)

Also in /etc/httpd/conf.d/mod_security.conf, or wherever the defaul config is stored, set SecRuleEngine Off but leave the other directives in place.

share|improve this answer
care to point out where I was wrong and why the answer was not useful? Just so that I know where I got it wrong. I usually do the exact opposite because I might need to temporarily disable mod_security on a particular website while I figure the problem while having it enabled on all other websites – thanosk Mar 13 '13 at 8:36
I also don't see where this answer is wrong, and would be very interested to know. – Jenny D Mar 13 '13 at 8:42
Giving error: "/httpdocs/.htaccess: SecRuleEngine not allowed here" Also, for latest mod-security, it is mod_security2.c and its not SecFilterEngine but SecRuleEngine. – Farhan Mar 13 '13 at 9:25
You are actually quite correct on both points. Kick me on the head for checking an old test server for the actual configuration and doing a copy paste without thinking much. Sorry about that and leason learned. Now going back to the original question: if .htaccess is not allowed for whatever reason can you move the mod_security configuration the the virtual host apache configuration ? I mean completely remove modsec config from httpd.conf and move anything you might need to the virtual host. – thanosk Mar 13 '13 at 9:39
yes, moved the this configuraton portion to vhost configuration file, and its working now. Thanks – Farhan Mar 13 '13 at 9:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.