{"id":1567,"date":"2026-01-01T21:31:43","date_gmt":"2026-01-01T21:31:43","guid":{"rendered":"https:\/\/b2bhostingclub.com\/blog\/?p=1567"},"modified":"2026-02-04T14:14:37","modified_gmt":"2026-02-04T14:14:37","slug":"how-to-install-the-modsecurity-apache-module","status":"publish","type":"post","link":"https:\/\/b2bhostingclub.com\/blog\/how-to-install-the-modsecurity-apache-module\/","title":{"rendered":"How to Install the ModSecurity Apache Module"},"content":{"rendered":"
\n
\n
\n

What is ModSecurity?<\/h2>\n
\n
\n
\n

ModSecurity is an open-source web application firewall (WAF) module for the Apache HTTP Server (Apache) and other web servers. It provides an additional layer of security by monitoring and filtering HTTP traffic between a client and a web application. The ModSecurity module is designed to protect web applications from various types of attacks, including but not limited to:
\nCross-Site Scripting (XSS) attacks:<\/b>ModSecurity can inspect and filter HTTP requests and responses for malicious scripts or code that could be injected into web pages to exploit vulnerabilities.
\nSQL Injection attacks:<\/b>ModSecurity can detect and block attempts to execute unauthorized SQL queries by analyzing and validating the contents of HTTP requests.
\nRemote File Inclusion (RFI) attacks:<\/b>ModSecurity can prevent attackers from including remote files into web applications, which could lead to the execution of malicious code.
\nLocal File Inclusion (LFI) attacks:<\/b>ModSecurity can detect and block attempts to include local files through web application vulnerabilities, which could expose sensitive system files.
\nCross-Site Request Forgery (CSRF) attacks:<\/b>ModSecurity can enforce security measures to ensure that requests made to a web application are legitimate and originated from authorized sources.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
\n
\n
\n

ModSecurity uses a rule-based engine to analyze and evaluate HTTP requests and responses based on predefined rulesets. These rulesets define patterns and conditions that trigger specific actions, such as blocking, logging, or modifying requests. ModSecurity supports custom rule creation, allowing administrators to tailor the security policies to their specific needs. In this blog, you will learn how to install the ModSecurity Apache module.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

\n
\n
\n

How to Install ModSecurity Apache Module<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n

Step 1. Install ModSecurity<\/h3>\n
\n
\n
\n

Open a terminal or SSH into your Ubuntu 20.04 server and using the following command the switch to the root user so you have the permission for later operations. Then, input password as prompted.<\/p>\n<\/div>\n<\/div>\n

\n
\n
$ sudo -i<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Switch<\/div>\n<\/div>\n<\/div>\n
\n
\n
Next, update the package repositories to ensure you have the latest package information.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ apt update -y<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"update<\/div>\n<\/div>\n<\/div>\n
\n
\n
Download and install the ModSecurity Apache module using the following command and type y and enter.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ apt install libapache2-mod-security2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"update<\/div>\n<\/div>\n<\/div>\n
\n
\n
Restart the Apache service<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ systemctl restart apache2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n
\n
\n
Ensure the installed software version is at least 2.9<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ apt-cache show libapache2-mod-security2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Ensure<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
Step 2. Configure ModSecurity<\/h3>\n
\n
\n
\n
Copy the default ModSecurity configuration file to a new file. Then edit the file with your preferred editor. In this case, we use the nano editor.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ cp \/etc\/modsecurity\/modsecurity.conf-recommended \/etc\/modsecurity\/modsecurity.conf\r\n$ nano \/etc\/modsecurity\/modsecurity.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Copy<\/div>\n<\/div>\n<\/div>\n
\n
\n
Change the value of SecRuleEngine from\u00a0DetectionOnly<\/b>\u00a0to\u00a0On<\/b>.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Change<\/div>\n<\/div>\n<\/div>\n
\n
\n
Then, save the changes by pressing Ctrl + X, followed by y and enter. Next restart Apache service.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ systemctl restart apache2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n
\n
\n
Download OWASP Core Rule Set<\/b><\/p>\n<\/div>\n<\/div>\n
\n
\n
The OWASP Core Rule Set (CRS) is a set of rules designed to enhance the security of web applications by providing protection against various types of attacks.The OWASP CRS is an open-source project driven by the community. It is continuously updated and maintained by a team of security professionals and volunteers, ensuring that it stays up-to-date with emerging threats and vulnerabilities. By downloading the CRS, you can benefit from the collective knowledge and expertise of the security community.<\/p>\n<\/div>\n<\/div>\n
\n
\n
Remember to regularly update the CRS ruleset to benefit from the latest security enhancements and improvements. To ensure you have the latest ModSecurity rules, you can download the latest ModSecurity Core Rule Set (CRS) from Open Web Application Security Project (OWASP) at\u00a0CoreRuleSet.org<\/a>\u00a0and replace the GitHub URL as needed.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ wget https:\/\/github.com\/coreruleset\/coreruleset\/archive\/v3.3.0.zip<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"download<\/div>\n<\/div>\n<\/div>\n
\n
\n
Verify the checksum of your downloaded file against the provided message digest, replacing “vFileName” with the actual file name (e.g. v3.3.0.zip).<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ sha1sum FileName.zip && echo ProvidedChecksum<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Verify<\/div>\n<\/div>\n<\/div>\n
\n
\n
Then, unzip the file.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ unzip FileName.zip<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"unzip<\/div>\n<\/div>\n<\/div>\n
\n
\n
Next, move the CRS setup file from the new directory into your ModSecurity directory.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ mv coreruleset-3.3.0\/crs-setup.conf.example \/etc\/modsecurity\/crs-setup.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"move<\/div>\n<\/div>\n<\/div>\n
\n
\n
You can also choose to move the rules directory from the new directory to your ModSecurity directory. This step is optional.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ mv coreruleset-3.3.0\/rules\/ \/etc\/modsecurity\/<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"move<\/div>\n<\/div>\n<\/div>\n
\n
\n
After that, edit your Apache security2.conf file to ensure it\u2019ll load ModSecurity rules. As always, we use the nano editor.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ nano \/etc\/apache2\/mods-enabled\/security2.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
In the configuration file, make sure the following two lines are included. If not, add them into the file. When you finish the editing, save the file.<\/p>\n<\/div>\n<\/div>\n
\n
\n
IncludeOptional \/etc\/modsecurity\/*.conf\r\nInclude \/etc\/modsecurity\/rules\/*.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"edit<\/div>\n<\/div>\n<\/div>\n
\n
\n
Restart the Apache service.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ systemctl restart apache2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n
\n
\n
If you cannot restart Apache, go back to Apache security2.conf file and comment out this file path by adding a # in the beginning of the line: # IncludeOptional \/usr\/share\/modsecurity-crs\/owasp-crs.load.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ nano \/etc\/apache2\/mods-enabled\/security2.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n
\n
\n
Now, you should be able to restart the Apache service.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ systemctl restart apache2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
Step 3. Test ModSecurity Configuration<\/h3>\n
\n
\n
\n
Now, we can create a test blocking rule and check if we will receive a 403 error and a ModSecurity log entry.<\/p>\n<\/div>\n<\/div>\n
\n
\n
Edit your default Apache configuration file. If you haven’t changed the default Apache configuration file, it should be \/etc\/apache2\/sites-available\/000-default.conf. In this example, we have change the default file to \/etc\/apache2\/sites-available\/mytestsite.com.conf. Replace the default configuration file with your default configuration file.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ nano \/etc\/apache2\/sites-available\/000-default.conf<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Edit<\/div>\n<\/div>\n<\/div>\n
\n
\n
At the bottom of the file, above , add the following custom ModSecurity rule. Feel free to change the id number and msg as desired.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ SecRuleEngine On\r\nSecRule ARGS:testparam \"@contains test\" \"id:999,deny,status:403,msg:'Test Successful'\"<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Edit<\/div>\n<\/div>\n<\/div>\n
\n
\n
Press Ctrl + X, then y and enter to save the changes.<\/p>\n<\/div>\n<\/div>\n
\n
\n
Restart the Apache service.<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ systemctl restart apache2<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Restart<\/div>\n<\/div>\n<\/div>\n
\n
\n
Open a browser, access your server IP or your domain on that server with ?testparam=test on the end (e.g. domain.com\/?testparam=test). In our case, we use mytestsite.com\/?testparam=test. As expected, we receive the 403 forbidden error.<\/p>\n<\/div>\n<\/div>\n
\n
\n
\"Test<\/div>\n<\/div>\n<\/div>\n
\n
\n
In your Apache error log for ModSecurity errors, you can also search for this log using your error message (\u201cTest Successful\u201d) or id number (999):<\/p>\n<\/div>\n<\/div>\n
\n
\n
$ cat \/var\/log\/apache2\/error.log | grep 'Test Successful'<\/pre>\n<\/div>\n<\/div>\n
\n
\n
\"Search<\/div>\n<\/div>\n<\/div>\n
\n
\n
Afterwards, you can delete this test rule from your configuration file.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
Conclusion<\/h2>\n<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
installing the ModSecurity Apache module is a valuable step in enhancing the security of your web server and protecting your web applications against common attacks. By following the installation steps outlined in this blog, you can easily integrate ModSecurity into your Apache server and leverage its powerful features to detect and prevent various types of web vulnerabilities. The ModSecurity module, with its extensive rule set, provides an additional layer of defense, giving you peace of mind and helping you meet security requirements. Please do remember to regularly update the rule set and fine-tune the configuration to ensure optimal protection without impacting legitimate traffic.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
What is ModSecurity? ModSecurity is an open-source web application firewall (WAF) module for the Apache HTTP Server (Apache) and other web servers. It provides an additional layer of security by monitoring and filtering HTTP traffic between a client and a web application. The ModSecurity module is designed to protect web applications from various types of […]<\/p>\n","protected":false},"author":4,"featured_media":1568,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1567","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux-hosting"],"_links":{"self":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/comments?post=1567"}],"version-history":[{"count":1,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1567\/revisions"}],"predecessor-version":[{"id":1569,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/posts\/1567\/revisions\/1569"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/media\/1568"}],"wp:attachment":[{"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/media?parent=1567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/categories?post=1567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/b2bhostingclub.com\/blog\/wp-json\/wp\/v2\/tags?post=1567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}