Free, but please sign in
ModSecurity Rule Builder is free to use. There is nothing to pay. Sign in or join with a free account to continue.
ModSecurity Rule Builder (v0.0.1 Beta)
Build, tune, and export ModSecurity v3 configs for Apache or the NGINX connector. Defaults to detection-only and uses OWASP CRS. No server-side persistence; your work stays in your browser.
What this is: a privacy-first ModSecurity rule generator. Start with a clean slate or import data, pick CRS paranoia/thresholds, select exclusions, define routes (methods, params, sizes), add upload rules, rate limits, and honeypots. Export ready-to-include .conf files for Apache or NGINX connectors.
How it works: we keep a positive model per-route and synthesize ModSecurity rules plus CRS tuning. You can optionally analyze server logs to infer a model, but the generator works standalone.
đź’ˇ Getting Started Tips
- Begin with the Generator tab to define your API/web routes
- Use the Regex Builder button to create and test path patterns
- Check the CRS Tuning tab to customize OWASP Core Rule Set settings
- Validate your rules in a test environment before production deployment
- Start with Paranoia Level 1 and increase gradually if needed
- Use the Help sidebar (right) for detailed guidance on each section
No routes yet. Click “Add Route” to start building a positive model.
Generator – How to use
Short guidance for this section.
- Add Route: define path as regex (LocationMatch).
- Select allowed methods, content-types, and body limits.
- Parameters: add name, type, and max length.
- Content-Types: pick from common MIME types or add custom.
- Per‑route exclusions: browse CRS, View, Use, or Build Regex to scope.
- Plugins: insert snippets from registry or local files (base64).
Need deeper docs? See CRS docs & Netnea tutorials.