ModSecurity is an effective firewall for Apache web servers that is employed to prevent attacks towards web apps. It monitors the HTTP traffic to a specific website in real time and prevents any intrusion attempts as soon as it identifies them. The firewall uses a set of rules to accomplish that - for example, attempting to log in to a script administration area unsuccessfully many times sets off one rule, sending a request to execute a particular file which could result in gaining access to the website triggers a different rule, and so on. ModSecurity is amongst the best firewalls around and it will preserve even scripts which are not updated often as it can prevent attackers from employing known exploits and security holes. Incredibly thorough info about each and every intrusion attempt is recorded and the logs the firewall maintains are far more comprehensive than the standard logs generated by the Apache server, so you could later analyze them and determine whether you need to take more measures so as to enhance the protection of your script-driven Internet sites.
ModSecurity in Hosting
ModSecurity comes by default with all hosting plans that we offer and it'll be switched on automatically for any domain or subdomain you add/create in your Hepsia hosting Control Panel. The firewall has 3 different modes, so you'll be able to activate and deactivate it with just a click or set it to detection mode, so it'll maintain a log of all attacks, but it shall not do anything to prevent them. The log for any of your Internet sites will contain detailed info including the nature of the attack, where it originated from, what action was taken by ModSecurity, and so forth. The firewall rules which we use are frequently updated and include both commercial ones that we get from a third-party security firm and custom ones that our system admins include in case that they detect a new sort of attacks. That way, the sites which you host here shall be far more protected with no action needed on your end.
ModSecurity in Dedicated Servers
ModSecurity is provided as standard with all dedicated servers that are set up with the Hepsia Control Panel and is set to “Active” automatically for any domain you host or subdomain which you create on the server. Just in case that a web app does not work properly, you can either switch off the firewall or set it to work in passive mode. The second means that ModSecurity will keep a log of any potential attack that may take place, but won't take any action to prevent it. The logs produced in passive or active mode will offer you more details about the exact file which was attacked, the type of the attack and the IP address it originated from, and so forth. This info shall enable you to choose what measures you can take to boost the protection of your websites, including blocking IPs or carrying out script and plugin updates. The ModSecurity rules which we use are updated regularly with a commercial package from a third-party security firm we work with, but occasionally our staff include their own rules as well if they discover a new potential threat.