If ModSecurity records a malicious request but the application still receives it, the engine is usually running in DetectionOnly. That mode evaluates rules and writes matches to logs, but it deliberately does not run disruptive actions. Blocking requires SecRuleEngine On, a loaded connector and ruleset in the active virtual host, inspection of the part of the request that contains the attack, and no earlier rule or override that exempts the transaction.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Work through the checks below in order. A rule match with no intervention points to enforcement or rule-flow configuration; no audit event points instead to routing, loading, logging, or inspection coverage.
As an Amazon Associate I earn from qualifying purchases.
Understand what ModSecurity is actually doing
ModSecurity has three engine states. The state that matters is the effective state for the server, virtual host, location, or transaction handling the request—not merely the value in a template file.
| Engine state | Rule processing | Disruptive actions | Typical purpose |
|---|---|---|---|
Off |
Rules are not processed. | None. | Disabled protection or an intentionally unprotected context. |
DetectionOnly |
Rules are evaluated and matches are logged. | Deny, block, drop, redirect, and other disruptive actions do not execute. | Initial deployment, troubleshooting, and false-positive tuning. |
On |
Rules are evaluated. | A matched rule can enforce its configured disruptive action. | Production enforcement after tuning. |
The ModSecurity configuration documentation states: “DetectionOnly evaluates and logs rules without executing disruptive actions.” Therefore, a successful HTTP response is expected when the engine is in that mode, even if the audit log contains a convincing SQL-injection, cross-site-scripting, or local-file-inclusion match.
#1 Best Overall
On is necessary but not sufficient. The matched rule must also carry a disruptive action, the transaction must not have been exempted, and the connector must support the directives and phase in which the rule runs.
1. Prove the effective engine mode
Start with the configuration that the protected request actually uses. Administrators often change a distribution template or a global include while a more specific virtual-host or location setting wins at runtime.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- Identify the listener, virtual host, and location that receive the test request. Include any reverse proxy or TLS-termination hop that may route around the protected server.
- Inspect the fully assembled configuration and every include loaded by that context. Look for
SecRuleEngine Off,SecRuleEngine DetectionOnly, and later occurrences ofSecRuleEngine. - Check per-location and per-transaction controls. A global
Oncan be changed for one route by a local setting or by a rule usingctl:ruleEngine=Off. - Keep the engine in
DetectionOnlywhile new rules or a new application route are being tuned. Change the effective production context toOnonly after reviewing the generated events. - Run the web server’s configuration syntax check before reloading. For Apache installations this is commonly
apachectl -t; for Nginx it is commonlynginx -t. Correct every syntax error before attempting a restart or reload.
SecRuleEngine DetectionOnly
SecRequestBodyAccess On
SecResponseBodyAccess OffThe example keeps request-body inspection enabled for testing while leaving response inspection disabled. Set each directive deliberately for the workload; do not assume that a value in a sample file is active.
2. Confirm the connector and ruleset are loaded in the active context
A running ModSecurity library does not prove that the request is being inspected. Confirm which generation is installed—ModSecurity 2.x or libModSecurity 3—and which Apache or Nginx connector invokes it. Their directives, module loading, and connector behavior are not identical.
Check the connector
- Verify that the web server process has the intended ModSecurity module or connector loaded.
- Confirm that the protected listener uses that process. A separate frontend, proxy, static server, or alternate virtual host can accept the request without invoking ModSecurity.
- Compare the directives in your configuration with the syntax supported by the installed engine generation and connector.
Check the ruleset
Confirm that the intended local rules or the OWASP Core Rule Set (CRS) are included after the engine is loaded and in the context inherited by the active virtual host. CRS supplies generic attack-detection rules for ModSecurity-compatible WAFs, including coverage for SQL injection, cross-site scripting, and local file inclusion. Loading the engine without loading CRS or local rules produces no useful match.
- Find the include statements for the ruleset and verify that the referenced files exist and are readable by the web-server process.
- Make sure the include occurs for the virtual host that receives the request, not only for a disabled or unused host.
- Check that a later include does not replace, disable, or remove the earlier rule set.
- Record the engine, connector, and ruleset versions from the active installation; use those values when interpreting syntax errors or unexpected behavior.
If the configuration fails to load, inspect the web-server error log for duplicate rule IDs, unsupported directives, quoting mistakes, missing include files, permission errors, or syntax copied from another engine generation. A failed include can leave the server running with less protection than the file layout suggests.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Read the complete audit transaction
An HTTP status code alone cannot tell you whether ModSecurity evaluated, logged, or disrupted a request. Preserve the complete audit transaction for diagnosis, then redact credentials, cookies, authorization headers, tokens, and personal data before sharing it.
Rank #2
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
A useful transaction should let you answer five questions:
- Which request and client produced the event?
- Which rule ID and message matched?
- Which variable contained the matched data?
- Was the transaction only logged, or was it actually disrupted?
- Which engine, connector, and ruleset versions were loaded?
| Audit evidence | Most likely interpretation | Next check |
|---|---|---|
| A rule ID and match are present, but the application succeeds. | The engine may be in DetectionOnly; the rule may lack a disruptive action; an inherited action may have changed; an earlier exemption may have short-circuited the flow; or the connector may not support the intended action. |
Verify the effective engine state, inspect rule actions and ordering, search for bypass controls, and confirm connector compatibility. |
| No audit event appears for the test. | The request may not have reached the protected listener or virtual host, the rules may not be loaded, audit logging may be disabled, or the payload may be outside the inspected transaction data. | Trace routing, includes, audit logging, and request-body coverage. |
| The server reports a configuration error while loading. | A duplicate ID, unsupported directive, quoting error, missing include, permission problem, or wrong-generation syntax prevented the intended configuration from loading. | Read the web-server error log and run the server’s configuration test before reloading. |
| The event identifies a body variable but contains incomplete or parsing-related details. | Request-body access, body-size limits, or parsing behavior may be preventing full inspection. | Check request-body directives and parser limits, then reproduce with a controlled payload. |
Do not treat a rule ID as proof of enforcement. It proves that a rule reached a matching phase; the transaction’s processing result and the effective controls determine whether the request was stopped.
4. Make sure the attack is in an inspected part of the request
Rules can only match data that ModSecurity has been configured to read. Request-body attacks are a common reason for an apparently healthy engine to miss a test.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Request bodies
Enable SecRequestBodyAccess On when the relevant payload is in a POST, JSON document, multipart upload, or another request body. Then verify that the body is within configured size limits and that the parser recognizes its content type. A rule that examines arguments or headers cannot see a malicious value that remains unread in the body.
URLs, arguments, and headers
For an attack in the URL, query string, or headers, confirm that the rule targets the corresponding transaction variables and that the request reaches the phase in which those variables exist. A successful body test does not prove coverage for headers, and a header test does not prove JSON parsing.
Responses
SecResponseBodyAccess On is separate from request inspection. Enable it only when a rule must examine returned HTML, JSON, or another response body. Turning on request-body access does not inspect responses, and turning on response access does not make request bodies visible.
| Where the suspicious value is | Control to verify | What a failure looks like |
|---|---|---|
| Query string or URL path | Request reaches the protected virtual host and the applicable argument or URI variables are inspected. | No event even though the same text in a body produces a match, or the request bypasses the protected listener. |
| Form, JSON, or multipart body | SecRequestBodyAccess On, adequate body limits, and successful parsing. |
Headers and URL are logged, but the malicious field in the body is absent from the transaction. |
| Response body | SecResponseBodyAccess On and a connector path that supports the required response phase. |
Request rules work, but content returned by the application is never evaluated. |
When the processing path is unclear, temporarily increase SecDebugLogLevel, reproduce one controlled request, and return the level to its normal value immediately afterward. High debug levels can affect performance and create sensitive, high-volume logs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
5. Trace rule flow and bypasses
Rules run in an ordered transaction. An earlier action can prevent a later detecting or blocking rule from running, even while the global engine remains On.
Search the effective rules and local overrides for:
allow, which can permit a transaction before later rules execute;skip, which bypasses selected rules;skipAfter, which jumps past a section of the rule set;ctl:ruleEngine=Off, which changes enforcement for the transaction or scope;ctl:auditEngine=Off, which can hide the evidence needed to diagnose a request;- per-location settings that differ from the global server configuration.
Review custom allowlists, authentication exceptions, health-check exclusions, and application-specific rules alongside CRS. A broad exception for an endpoint can unintentionally cover every parameter on that route. Replace it with the narrowest supported exclusion—ideally one parameter, path, or rule target—rather than disabling an entire rule family.
Document every exclusion
For each exception, record the affected route or parameter, the rule ID, the reason, the application version, the owner, and a safe reproduction that demonstrates the false positive. Re-test the original attack case and the legitimate request after changing the exclusion. This makes later CRS or application updates reviewable instead of silently expanding the bypass.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →6. Verify that traffic reaches the protected path
No audit event is often a routing problem rather than a detection problem. Trace the request from the client to the listener that actually loads ModSecurity.
- Send a controlled request to the same hostname, port, protocol, and path used by the affected client.
- Identify every proxy, load balancer, cache, and TLS-termination hop. Confirm which hop forwards the request to the ModSecurity-enabled server.
- Check the selected virtual host and location, including host-header and path-based routing.
- Compare the request timestamp and client details with the web-server access log and ModSecurity audit log.
- Repeat the test directly against the protected backend only if doing so is safe and permitted; a difference proves that the public route is bypassing the inspected listener.
If the access log records the request but the audit log does not, investigate module loading, audit-engine settings, and the selected context. If neither log records it, continue upstream with routing and network diagnosis.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.7. Roll out blocking without locking out legitimate users
A controlled rollout separates false-positive tuning from enforcement changes.
- Establish a baseline. Put the new or changed rules in
DetectionOnlyand exercise normal application workflows, including uploads, APIs, authentication, and administrative paths. - Review events. Group matches by rule ID, route, parameter, content type, user action, and application version. Confirm that each event represents the intended traffic and not a parser artifact.
- Tune narrowly. Adjust the affected parameter or route, preserve coverage for the rest of the request, and document the reason and reproduction.
- Validate configuration. Run the server syntax check, verify that the active virtual host inherits the final includes, and confirm that the connector and ruleset versions are the ones you tested.
- Enable enforcement. Change the effective context to
SecRuleEngine On, reload safely, and monitor both audit events and application error rates. - Re-test. Use a harmless, controlled test that should trigger the rule. Confirm the audit transaction shows the disruptive result and that the application does not receive the request.
- Revert diagnostically. If behavior is unexpected, return to
DetectionOnlyfor the affected scope, preserve the transaction, and investigate rather than applying a global disable.
Not every rule is designed to stop every match. Enforcement depends on the rule’s action and the connector’s support for it. A blocked request may produce a 403 response, a dropped connection, or another configured result; the audit transaction is the authoritative record of what happened.
Common failure patterns and precise fixes
“The log says matched, but users receive 200.”
Check SecRuleEngine DetectionOnly first. If the effective state is On, inspect the matched rule’s actions, inherited action changes, and earlier allow, skip, skipAfter, or ctl directives. Then confirm that the connector supports the disruptive action in that phase.
“The global setting is On, but one endpoint is unprotected.”
Compare the endpoint’s virtual-host and location configuration with the working route. Look for a local Off or DetectionOnly, a transaction-level control, a proxy path that terminates before ModSecurity, or an include that is absent from that context.
“GET attacks are detected, but JSON or multipart attacks are not.”
Verify SecRequestBodyAccess On, body-size limits, content-type parsing, and the variables targeted by the rules. Confirm that the test payload is actually present in the audit transaction.
“Nothing appears in the audit log.”
Prove that the request reaches the protected listener and virtual host, confirm that the intended rules and include files loaded, check audit logging, and verify that the tested data is in an inspected phase or variable.
“The server will not reload after a rules change.”
Read the error log for duplicate IDs, unsupported directives, malformed quoting, missing files, permissions, and syntax from the other engine generation. Correct the reported line, rerun the configuration test, and reload only after it passes.
Compatibility checks before changing production policy
Record the exact ModSecurity generation, Apache or Nginx connector, CRS release, and local rule revision in the change record. A directive copied from a ModSecurity 2.x deployment may not behave the same way with libModSecurity 3, and a ruleset update can expose assumptions in old exclusions. Validate the combination in the same listener and virtual-host context that serves production traffic.
- Coverage: The intended CRS or local rules are loaded and inspect the relevant phase and variable.
- Enforcement: The effective engine is
On, and the matched rule has a disruptive action. - Scope: The request reaches the protected connector, listener, and virtual host.
- Inspection depth: Request bodies, multipart data, JSON, and response bodies are enabled only where required.
- Safety: False positives are handled with narrow, documented exclusions rather than global disabling.
- Compatibility: Engine generation, connector, directive support, and CRS version are a tested combination.
Production verification checklist
- Record the effective
SecRuleEnginevalue in the serving context. - Confirm the connector and engine generation loaded by the running server.
- Confirm that CRS or the intended local rules are included and inherited by the active virtual host.
- Verify audit logging and preserve a redacted complete transaction for each test.
- Check the rule ID, matched variable, processing result, and loaded versions.
- Enable
SecRequestBodyAccess Onfor body-based tests and verify parsing and limits. - Enable
SecResponseBodyAccess Ononly for response inspection. - Search for
allow,skip,skipAfter, andctlbypasses. - Run the web-server configuration test before every reload.
- Use temporary high debug logging only for a controlled reproduction, then reduce it.
- Move from
DetectionOnlytoOnonly after false-positive tuning and a documented rollback path.
Bottom line
ModSecurity is not failing merely because it logs an attack that reaches the application. A log match in DetectionOnly is the expected result of a functioning detection engine. Blocking begins when the effective context uses SecRuleEngine On, the correct connector and CRS or local rules are loaded, the relevant request data is inspected, and no earlier rule-flow or route exemption bypasses the match. Audit transactions, configuration tests, and narrow, documented exclusions provide the evidence needed to make that change safely.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
