ModSecurity™ Vendors WHM

I was told that most web hosting companies do not use any ModSecurity Sets on there servers is this correct?
 
Who told you that, or where did you read it?

I know plenty of hosts that are using ModSecurity rules on servers. I know some don't but I don't think I"d say "most do not use it".
 
Did you check the date on that article? 2008.

There's a lot of things that mod_security can do to help protect a website, but it does use resources (just like any software running on a machine).

If you're using an enterprise grade firewall on a separate machine prior to the user ending up on your phsycal device, then often the work is handled by those machines and you can safely disable mod_security on your individual server (or on a domain by domain basis).

Disabling as a general rule is not normal from what I remember. There are places like Kinsta and WPEngine that disable it by default, but they've offloaded the protection to a separate firewall.

I guess it will depend on how your security is setup, and what you're using as a firewall before hitting your physical machine. The VPS machines that I currently utilize still have mod_security on them, with explicit instructions based on what the machines are designed to do.

We've not had issues with resources, but then on the VPS machines, they're not configured for heavy loads either. Sites with heavy loads are usually shifted off to other locations, utilizing load balancing etc, and at that point utilizing separate WAF systems that negate the need for mod_security.

mod_security itself is designed to detect certain rules and then act upon them. Usually you design it so that it prevents certain situations rather than specifying all the things that it CAN do. As a result, the load impact is usually minimal as it's only looking for things that it CAN'T do, similar to what a software firewall (ConfigServer Firewall for example) operates.
 
You must log in or register to reply here.

Supporters

Back
Top