Mod_security Conf

<IfModule security2_module>

	# Turn the filtering engine On or Off
	SecRuleEngine On

	# The audit engine works independently and
	# can be turned On of Off on the per-server or
	# on the per-directory basis
	SecAuditEngine RelevantOnly

	# The name of the audit log file
	SecAuditLog "d:/wamp/logs/modsec_log.log"

	# Action to take by default
	SecDefaultAction "deny,phase:2,status:403"

	# Prevent path traversal (..) attacks
	SecRule ARGS "\.\./" "t:normalizePathWin,id:50904,severity:4,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:lowercase,msg:'Drive Access'"

	# Maximum request body size we will accept for buffering. If you support
	# file uploads then the value given on the first line has to be as large
	# as the largest file you are willing to accept. The second value refers
	# to the size of data, with files excluded. You want to keep that value as
	# low as practical.
	SecRequestBodyLimit 13107200
	SecRequestBodyNoFilesLimit 131072

	# Store up to 128 KB of request body data in memory. When the multipart
	# parser reachers this limit, it will start using your hard disk for
	# storage. That is slow, but unavoidable.
	SecRequestBodyInMemoryLimit 131072

	# What do do if the request body size is above our configured limit.
	# Keep in mind that this setting will automatically be set to ProcessPartial
	# when SecRuleEngine is set to DetectionOnly mode in order to minimize
	# disruptions when initially deploying ModSecurity.
	SecRequestBodyLimitAction Reject

	# Verify that we've correctly processed the request body.
	# As a rule of thumb, when failing to process a request body
	# you should reject the request (when deployed in blocking mode)
	# or log a high-severity alert (when deployed in detection-only mode).
	SecRule REQBODY_ERROR "!@eq 0" \
			"id:'200001', phase:2,t:none,log,deny,status:400,msg:'Failed to parse request body.',logdata:'%{reqbody_error_msg}',severity:2"

	# By default be strict with what we accept in the multipart/form-data
	# request body. If the rule below proves to be too strict for your
	# environment consider changing it to detection-only. You are encouraged
	# _not_ to remove it altogether.
	SecRule MULTIPART_STRICT_ERROR "!@eq 0" \
	"id:'200002',phase:2,t:none,log,deny,status:44, \
	msg:'Multipart request body failed strict validation: \
	PE %{REQBODY_PROCESSOR_ERROR}, \
	BQ %{MULTIPART_BOUNDARY_QUOTED}, \
	BW %{MULTIPART_BOUNDARY_WHITESPACE}, \
	DB %{MULTIPART_DATA_BEFORE}, \
	DA %{MULTIPART_DATA_AFTER}, \
	HF %{MULTIPART_HEADER_FOLDING}, \
	LF %{MULTIPART_LF_LINE}, \
	SM %{MULTIPART_MISSING_SEMICOLON}, \
	IQ %{MULTIPART_INVALID_QUOTING}, \
	IP %{MULTIPART_INVALID_PART}, \
	IH %{MULTIPART_INVALID_HEADER_FOLDING}, \
	FL %{MULTIPART_FILE_LIMIT_EXCEEDED}'"

	# Did we see anything that might be a boundary?
	SecRule MULTIPART_UNMATCHED_BOUNDARY "!@eq 0" \
			"id:'200003',phase:2,t:none,log,deny,msg:'Multipart parser detected a possible unmatched boundary.'"

	# PCRE Tuning
	# We want to avoid a potential RegEx DoS condition
	SecPcreMatchLimit 1000
	SecPcreMatchLimitRecursion 1000

	# Some internal errors will set flags in TX and we will need to look for these.
	# All of these are prefixed with "MSC_". The following flags currently exist:
	#
	# MSC_PCRE_LIMITS_EXCEEDED: PCRE match limits were exceeded.
	SecRule TX:/^MSC_/ "!@streq 0" \
			"id:'200004',phase:2,t:none,deny,msg:'ModSecurity internal error flagged: %{MATCHED_VAR_NAME}'"

	# -- Response body handling --------------------------------------------------

	# Allow ModSecurity to access response bodies.
	# You should have this directive enabled in order to identify errors
	# and data leakage issues.
	#
	# Do keep in mind that enabling this directive does increases both
	# memory consumption and response latency.
	#
	SecResponseBodyAccess On

	# Which response MIME types do you want to inspect? You should adjust the
	# configuration below to catch documents but avoid static files
	# (e.g., images and archives).
	#
	SecResponseBodyMimeType text/plain text/html text/xml

	# Buffer response bodies of up to 512 KB in length.
	SecResponseBodyLimit 524288

	# What happens when we encounter a response body larger than the configured
	# limit? By default, we process what we have and let the rest through.
	# That's somewhat less secure, but does not break any legitimate pages.
	#
	SecResponseBodyLimitAction ProcessPartial

	# -- Miscellaneous -----------------------------------------------------------

	# Use the most commonly used application/x-www-form-urlencoded parameter
	# separator. There's probably only one application somewhere that uses
	# something else so don't expect to change this value.
	#
	SecArgumentSeparator &

	# Settle on version 0 (zero) cookies, as that is what most applications
	# use. Using an incorrect cookie version may open your installation to
	# evasion attacks (against the rules that examine named cookies).
	#
	SecCookieFormat 0

	# Specify your Unicode Code Point.
	# This mapping is used by the t:urlDecodeUni transformation function
	# to properly map encoded data to your language. Properly setting
	# these directives helps to reduce false positives and negatives.
	#
	#SecUnicodeCodePage 20127
	#SecUnicodeMapFile unicode.mapping

</IfModule>