VirtualHost {
   Hostname = www.mysite.com, mysite.com
   WebsiteRoot = /var/www/mysite
   StartFile = index.php
   AccessLogfile = /var/log/hiawatha/access.log
   ErrorLogfile = /var/log/hiawatha/error.log
   TimeForCGI = 1000
#   UseFastCGI = PHP5
   UseToolkit = banshee
   # if ownCloud or alike is installed, otherwise, it should be "no"
#   WebDAVapp = yes
   # <script .. </script>
   # e.g. <script>alert("xss");</script>
   DenyBody = ^.*%3Cscript.*%3C%2Fscript%3E.*$
   DenyBody = ^.*%3CsCrIpT.*%3C%2FScRiPt%3E.*$
   DenyBody = ^.*%3CScRiPt.*%3C%2FsCrIpT%3E.*$
   DenyBody = ^.*%3CSCRIPT.*%3C%2FSCRIPT%3E.*$
   DenyBody = ^.*%3CSCRIPT.*%3C%2Fscript%3E.*$
   DenyBody = ^.*%3Cscript.*%3C%2FSCRIPT%3E.*$
   # <meta .. />
   # e.g. <meta http-equiv="refresh" content='0; URL=http://some.domain"/>
   DenyBody = ^.*%3Cmeta.*%2F%3E.*$
   DenyBody = ^.*%3CMETA.*%2F%3E.*$
   DenyBody = ^.*%3CMeTa.*%2F%3E.*$
   DenyBody = ^.*%3CmEtA.*%2F%3E.*$
   # <iframe .. />
   DenyBody = ^.*%3Ciframe.*%2F%3E.*$
   DenyBody = ^.*%3CIFRAME.*%2F%3E.*$
   # Null Byte
   DenyBody = ^.*%00.*$
   ExecuteCGI = yes
   PreventCSRF = yes
   PreventSQLi = yes
   PreventXSS = yes
   WrapCGI = jail_mysite
}