How to Install ModSecurity on CentOS 7.x with Apache?

ModSecurity is an open-source web application firewall that monitors incoming web requests to a web server in real time. It protects your web application against attacks such as session hijacking, SQL injection, cross-site scripting, etc., on web applications using the added rulesets. It is supported by the web browsers such as Apache, Nginx, and IIS.

Please refer to the following steps to install mod security on CentOS 7.x –

1. First, run the below command to update the software repository –

sudo yum update -y

2. Install ModSecurity using the command given below –

sudo yum install mod_security -y

3. You can check the mod security version with this command –

sudo yum info mod_security

Configure ModSecurity

After the installation, configure ModSecurity to detect and log any suspicious activity.

1. We will copy the default ModSecurity config file to a new file.

sudo cp /etc/modsecurity/modsecurity.conf-recommended /etc/modsecurity/modsecurity.conf

2. Open the ModSecurity.conf file in your preferred editor.

vi /etc/modsecurity/modsecurity.conf

3. At the top of the file, locate SecRuleEngine DetectionOnly. Change the DetectionOnly to On.

DetectionOnly On

4. Save your changes to the ModSecurity.conf file.

5. Restart the Apache service on your server.

systemctl restart apache2

How to Download OWASP Core Rule Set

We can download the latest ModSecurity core ruleset (CRS) from the Open Web Application Security Project (OWASP) at to ensure that we have the latest ModSecurity rules.

1. Run the below command to install Git –

sudo yum install git

2. Download the CRS copy from git using this command –

git clone

3. Open it with the cd command.

cd owasp-modsecurity-crs

4. Move the CRS file and the rules to mod security.

sudo mv crs-setup.conf.example /etc/modsecurity/crs-setup.conf

sudo mv rules/ /etc/modsecurity

5. Open the security2.conf file and verify that it is set to load mod_security rules.

sudo nano /etc/apache2/mods-enabled/security2.conf

6. The two lines given below should remain uncommented –

IncludeOptional /etc/modsecurity/*.conf

Include /etc/modsecurity/rules/*.conf

7. Restart the Apache service with this command –

sudo systemctl restart httpd.service

Was this answer helpful?

« Back