{"id":9684,"date":"2025-12-31T12:30:52","date_gmt":"2025-12-31T07:00:52","guid":{"rendered":"https:\/\/pheonixsolutions.com\/blog\/?p=9684"},"modified":"2025-12-31T12:53:12","modified_gmt":"2025-12-31T07:23:12","slug":"installing-modsecurity-with-owasp-crs-on-apache-ubuntu","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/","title":{"rendered":"Installing ModSecurity with OWASP CRS on Apache (Ubuntu)"},"content":{"rendered":"\n

Introduction<\/strong><\/p>\n\n\n\n

Web applications are constantly exposed to attacks such as SQL injection, cross-site scripting (XSS), command injection, and malicious bots. A Web Application Firewall (WAF) helps protect applications by inspecting HTTP traffic and blocking suspicious requests before they reach your application.
ModSecurity is a widely used open-source WAF, and when combined with the OWASP Core Rule Set (CRS), it provides strong, community-maintained protection against common web attacks.<\/p>\n\n\n\n

Prerequisites<\/strong>
1. Ubuntu 20.04 \/ 22.04 \/ 24.04 server
2. Apache Web Server installed
3. Root or sudo access
4. Basic knowledge of Linux command line
5. An active website or virtual host (optional but recommended for testing)<\/p>\n\n\n\n

Implementation<\/strong><\/p>\n\n\n\n

Step 1: Install Apache and ModSecurity
<\/strong>Update the system packages:
$ sudo apt update && sudo apt upgrade -y<\/p>\n\n\n\n

Install Apache and the ModSecurity Apache module
$ sudo apt install apache2 libapache2-mod-security2 -y<\/p>\n\n\n\n

Enable the ModSecurity module and restart Apache
$ sudo a2enmod security2
$ sudo systemctl restart apache2<\/p>\n\n\n\n

Step 2: Enable ModSecurity Configuration
<\/strong>By default, ModSecurity runs in detection mode. Enable the recommended configuration
$ sudo mv \/etc\/modsecurity\/modsecurity.conf-recommended \/etc\/modsecurity\/modsecurity.conf<\/p>\n\n\n\n

Edit the configuration file
$ sudo nano \/etc\/modsecurity\/modsecurity.conf
Find the following line and change it to:
“SecRuleEngine DetectionOnly”
“SecRuleEngine On”<\/p>\n\n\n\n

Save the file and restart Apache
$ sudo systemctl restart apache2<\/p>\n\n\n\n

Step 3: Download and Install OWASP Core Rule Set (CRS)
<\/strong>Create a directory for ModSecurity rules
$ sudo mkdir \/etc\/apache2\/modsec
$ cd \/etc\/apache2\/modsec<\/p>\n\n\n\n

Download the latest OWASP CRS release
$ sudo wget https:\/\/github.com\/coreruleset\/coreruleset\/archive\/refs\/tags\/v3.3.4.tar.gz
$ sudo tar xvf v3.3.4.tar.gz
Copy the CRS setup file
$ sudo cp coreruleset-3.3.4\/crs-setup.conf.example coreruleset-3.3.4\/crs-setup.conf<\/p>\n\n\n\n

Step 4: Enable CRS Rules in Apache
<\/strong>Edit the ModSecurity Apache configuration
$ sudo nano \/etc\/apache2\/mods-enabled\/security2.conf<\/p>\n\n\n\n


Inside the <IfModule security2_module> block, add
Include \/etc\/apache2\/modsec\/coreruleset-3.3.4\/crs-setup.conf
Include \/etc\/apache2\/modsec\/coreruleset-3.3.4\/rules\/*.conf<\/p>\n\n\n\n


If you see any default CRS includes, comment them out to avoid conflicts
# IncludeOptional \/usr\/share\/modsecurity-crs\/*.load<\/p>\n\n\n\n

Restart Apache
$ sudo systemctl restart apache2<\/p>\n\n\n\n

Step 5: Verify ModSecurity and CRS
<\/strong>Test by sending a malicious-looking request in the browser
https:\/\/yourdomain.com\/?cmd=\/bin\/bash
If ModSecurity and CRS are working correctly, Apache should return a 403 Forbidden response.<\/p>\n\n\n\n

Conclusion<\/strong><\/p>\n\n\n\n

ModSecurity with the OWASP Core Rule Set provides an effective and easy-to-deploy security layer for Apache web servers. By enabling CRS rules, your server can automatically detect and block common web attacks such as SQL injection, XSS, and malicious requests. With proper monitoring and gradual tuning, this setup helps improve overall web application security while minimizing false positives, making it a reliable first line of defense for production environments.<\/p>\n","protected":false},"excerpt":{"rendered":"

Introduction Web applications are constantly exposed to attacks such as SQL injection, cross-site scripting (XSS), command injection, and malicious bots. A Web Application Firewall (WAF) helps protect applications by inspecting HTTP traffic and blocking suspicious requests before they reach your application.ModSecurity is a widely used open-source WAF, and when combined… Continue Reading Installing ModSecurity with OWASP CRS on Apache (Ubuntu)<\/span><\/i><\/a><\/p>\n","protected":false},"author":495,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[637,224,282],"tags":[1009],"class_list":{"0":"post-9684","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"hentry","6":"category-apache-2","7":"category-server-hardening","8":"category-ubuntu","9":"tag-mod_security","10":"h-entry","12":"h-as-article"},"yoast_head":"\nPheonix Solutions - We Empower Your Business Growth<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pheonix Solutions - We Empower Your Business Growth\" \/>\n<meta property=\"og:description\" content=\"Introduction Web applications are constantly exposed to attacks such as SQL injection, cross-site scripting (XSS), command injection, and malicious bots. A Web Application Firewall (WAF) helps protect applications by inspecting HTTP traffic and blocking suspicious requests before they reach your application.ModSecurity is a widely used open-source WAF, and when combined… Continue Reading Installing ModSecurity with OWASP CRS on Apache (Ubuntu)\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/\" \/>\n<meta property=\"og:site_name\" content=\"PHEONIXSOLUTIONS\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/PheonixSolutions-209942982759387\/\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-31T07:00:52+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-12-31T07:23:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2016\/09\/PX2.png\" \/>\n\t<meta property=\"og:image:width\" content=\"3837\" \/>\n\t<meta property=\"og:image:height\" content=\"2540\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"meenakshi k\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@pheonixsolution\" \/>\n<meta name=\"twitter:site\" content=\"@pheonixsolution\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"meenakshi k\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/\"},\"author\":{\"name\":\"meenakshi k\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d573de3a2c02cbeca49e90581a88b98f\"},\"headline\":\"Installing ModSecurity with OWASP CRS on Apache (Ubuntu)\",\"datePublished\":\"2025-12-31T07:00:52+00:00\",\"dateModified\":\"2025-12-31T07:23:12+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/\"},\"wordCount\":433,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#organization\"},\"keywords\":[\"mod_security\"],\"articleSection\":[\"Apache\",\"Server Hardening\",\"Ubuntu\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/\",\"name\":\"Pheonix Solutions - We Empower Your Business Growth\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#website\"},\"datePublished\":\"2025-12-31T07:00:52+00:00\",\"dateModified\":\"2025-12-31T07:23:12+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Installing ModSecurity with OWASP CRS on Apache (Ubuntu)\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/\",\"name\":\"Pheonix Solutions\",\"description\":\"We Empower Your Business Growth\",\"publisher\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#organization\",\"name\":\"PheonixSolutions\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/12\\\/logo.png\",\"contentUrl\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/wp-content\\\/uploads\\\/2016\\\/12\\\/logo.png\",\"width\":454,\"height\":300,\"caption\":\"PheonixSolutions\"},\"image\":{\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/PheonixSolutions-209942982759387\\\/\",\"https:\\\/\\\/x.com\\\/pheonixsolution\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/#\\\/schema\\\/person\\\/d573de3a2c02cbeca49e90581a88b98f\",\"name\":\"meenakshi k\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/17c0a3923b9a31a41d8de2fdc928e514efe879fe17b6e5d2814b7f81ed2356e5?s=96&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/17c0a3923b9a31a41d8de2fdc928e514efe879fe17b6e5d2814b7f81ed2356e5?s=96&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/17c0a3923b9a31a41d8de2fdc928e514efe879fe17b6e5d2814b7f81ed2356e5?s=96&r=g\",\"caption\":\"meenakshi k\"},\"url\":\"https:\\\/\\\/pheonixsolutions.com\\\/blog\\\/author\\\/meenakshi\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Pheonix Solutions - We Empower Your Business Growth","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/","og_locale":"en_US","og_type":"article","og_title":"Pheonix Solutions - We Empower Your Business Growth","og_description":"Introduction Web applications are constantly exposed to attacks such as SQL injection, cross-site scripting (XSS), command injection, and malicious bots. A Web Application Firewall (WAF) helps protect applications by inspecting HTTP traffic and blocking suspicious requests before they reach your application.ModSecurity is a widely used open-source WAF, and when combined… Continue Reading Installing ModSecurity with OWASP CRS on Apache (Ubuntu)","og_url":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/","og_site_name":"PHEONIXSOLUTIONS","article_publisher":"https:\/\/www.facebook.com\/PheonixSolutions-209942982759387\/","article_published_time":"2025-12-31T07:00:52+00:00","article_modified_time":"2025-12-31T07:23:12+00:00","og_image":[{"width":3837,"height":2540,"url":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2016\/09\/PX2.png","type":"image\/png"}],"author":"meenakshi k","twitter_card":"summary_large_image","twitter_creator":"@pheonixsolution","twitter_site":"@pheonixsolution","twitter_misc":{"Written by":"meenakshi k","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/#article","isPartOf":{"@id":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/"},"author":{"name":"meenakshi k","@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/person\/d573de3a2c02cbeca49e90581a88b98f"},"headline":"Installing ModSecurity with OWASP CRS on Apache (Ubuntu)","datePublished":"2025-12-31T07:00:52+00:00","dateModified":"2025-12-31T07:23:12+00:00","mainEntityOfPage":{"@id":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/"},"wordCount":433,"commentCount":0,"publisher":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#organization"},"keywords":["mod_security"],"articleSection":["Apache","Server Hardening","Ubuntu"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/","url":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/","name":"Pheonix Solutions - We Empower Your Business Growth","isPartOf":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#website"},"datePublished":"2025-12-31T07:00:52+00:00","dateModified":"2025-12-31T07:23:12+00:00","breadcrumb":{"@id":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/pheonixsolutions.com\/blog\/installing-modsecurity-with-owasp-crs-on-apache-ubuntu\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/pheonixsolutions.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Installing ModSecurity with OWASP CRS on Apache (Ubuntu)"}]},{"@type":"WebSite","@id":"https:\/\/pheonixsolutions.com\/blog\/#website","url":"https:\/\/pheonixsolutions.com\/blog\/","name":"Pheonix Solutions","description":"We Empower Your Business Growth","publisher":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/pheonixsolutions.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/pheonixsolutions.com\/blog\/#organization","name":"PheonixSolutions","url":"https:\/\/pheonixsolutions.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2016\/12\/logo.png","contentUrl":"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2016\/12\/logo.png","width":454,"height":300,"caption":"PheonixSolutions"},"image":{"@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/PheonixSolutions-209942982759387\/","https:\/\/x.com\/pheonixsolution"]},{"@type":"Person","@id":"https:\/\/pheonixsolutions.com\/blog\/#\/schema\/person\/d573de3a2c02cbeca49e90581a88b98f","name":"meenakshi k","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/17c0a3923b9a31a41d8de2fdc928e514efe879fe17b6e5d2814b7f81ed2356e5?s=96&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/17c0a3923b9a31a41d8de2fdc928e514efe879fe17b6e5d2814b7f81ed2356e5?s=96&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/17c0a3923b9a31a41d8de2fdc928e514efe879fe17b6e5d2814b7f81ed2356e5?s=96&r=g","caption":"meenakshi k"},"url":"https:\/\/pheonixsolutions.com\/blog\/author\/meenakshi\/"}]}},"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p7F4uM-2wc","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/495"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=9684"}],"version-history":[{"count":3,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9684\/revisions"}],"predecessor-version":[{"id":9687,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/9684\/revisions\/9687"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=9684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=9684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=9684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}