New answers tagged mod-security
Here is a modified rule that fits the purpose, been running for 48 hours now, Google and others work fine while baddies still get caught, wohoo! Add this to the vhost in question: SecRule REQUEST_HEADERS:User-Agent "Google|Mail|Yandex" "phase:1,t:none,allow,nolog,ctl:ruleRemoveById=960015"
First a disclaimer: I'm the author of Bad Behavior, a similar product, and some of the ModSecurity core rules were derived from Bad Behavior. RFC 2616 states that the Accept header SHOULD be present in all requests. Note that this isn't an absolute requirement, so a user-agent is still conditionally compliant (as defined in the RFC) if it doesn't send this ...
Top 50 recent answers are included