ModSecurity — Web Application Firewall
The Apache/Nginx security module that inspects every HTTP request in real time. Blocks SQL injection, XSS, file inclusion and OWASP Top 10 attacks — before your code ever sees them.
What is ModSecurity?
ModSecurity is the most popular open-source Web Application Firewall in the world, integrated directly into the Apache server. It acts as an inspector of every HTTP request — analyzing the URL, parameters, headers and body before your application receives the request.
OWASP Core Rule Set (CRS) rules
Uses the OWASP CRS rules — the industry standard for WAFs. Covers SQL injection, XSS, CSRF, RFI, LFI, automated scanners and HTTP header injection.
Full inspection mode
Analyzes HTTP requests in all phases: request headers, request body, response headers and response body — blocking is possible at any point in the cycle.
Automatically updated rules
On Trustnet Solutions servers, ModSecurity rules are updated automatically through Imunify360. New vulnerabilities (CVE) are covered within hours of publication.
Detailed logging
Every blocked request is logged with full details: source IP, triggered rule, malicious parameter and reason for blocking — available in cPanel → Imunify360.
HTTP request received
POST /contact.php — params, body, headers
ModSecurity inspects
~1,200 OWASP CRS rules checked
SQL Injection detected
param name: OR 1=1--
Legitimate request — Passes
Reaches PHP/application
Which attacks ModSecurity blocks
OWASP Top 10 and beyond — ModSecurity covers every major web attack vector.
SQL Injection (SQLi)
Detects and blocks attempts to manipulate SQL queries — union-based, blind, time-based and error-based injection.
Cross-Site Scripting (XSS)
Blocks the injection of malicious scripts through GET/POST parameters, cookies and HTTP headers — reflected, stored and DOM-based XSS.
Remote File Inclusion (RFI)
Prevents the inclusion of malicious external files through URL parameters — a common attack vector in vulnerable PHP applications.
Local File Inclusion (LFI)
Blocks directory traversal attempts (../../etc/passwd) and access to sensitive files on the server.
Automated scanner blocking
Detects and blocks automated vulnerability scanning tools (sqlmap, nikto, acunetix, nmap, nuclei) based on request patterns.
HTTP Header Injection
Prevents the injection of malicious HTTP headers used for response splitting, cache poisoning and cookie hijacking attacks.
Specialized rules per application
In addition to the generic OWASP CRS, ModSecurity on Trustnet Solutions servers includes rules specific to the most popular web applications.
WordPress protection
Specific rules for wp-login.php, xmlrpc.php, known plugin vulnerabilities, REST API abuse and actively exploited WordPress flaws (recent CVEs).
Control panel protection
Rules for the cPanel Web UI, WHM, Webmail and the cPanel APIs — blocks authentication bypass attempts and control-panel exploits.
Generic PHP protection
Covers deserialization attacks, object injection, exec/system function abuse, malware uploads via $_FILES and dangerous PHP parameters — independent of the CMS used.
About ModSecurity
What you need to know about the WAF on Trustnet Solutions servers.
Active on all plans
ModSecurity runs across the entire Trustnet Solutions shared infrastructure
Rules updated daily
Protection against newly discovered vulnerabilities
ModSecurity WAF included as standard
All Trustnet Solutions plans include ModSecurity active with OWASP CRS rules and WordPress/cPanel rule sets updated daily and automatically through Imunify360.
It works transparently behind the Apache server — it requires no configuration and does not affect the experience of legitimate users.