WAF · Open source
ModSecurity / OWASP CRS
Difficulty 1/5
The open-source WAF that ships with a lot of hosting. Pure request-signature matching — no fingerprinting, no challenge, no reputation.
- TLS fingerprinting
- JS challenge required
- Behavioural scoring
- IP reputation weight: low
How it decides
-
Regex rule sets (usually the OWASP Core Rule Set) matched against URL, headers and body.
-
An anomaly score accumulated per request, blocking above a threshold.
-
No notion of who you are — only of what your request looks like.
What you see when it stops you
- “Not Acceptable!” from an Apache-branded page
- `server: Mod_Security`, or a `mod_security` string in the body
- 403s that depend entirely on the URL, not on the client
Signatures the detector matches
Publicly observable artefacts ModSecurity / OWASP CRS sends to every visitor. Paste a response into the analyser and these are what it looks for.
| Where | Signal | Weight |
|---|---|---|
| Header | server: Mod_Security | 70 |
| Page markup | ModSecurity block text | 60 |
| Page markup | “Not Acceptable!” CRS page | 35 |
| Status | 406 Not Acceptable | 15 |
What actually gets through
-
Static ISP addresses. Address quality is irrelevant here.
-
Clean up the request rather than the identity — a normal browser header set clears most CRS rules.
-
Watch for accidental rule triggers in query strings; punctuation-heavy parameters are a common cause.
Not sure this is what
is blocking you?
Paste the response you actually got. The detector names the vendor from its own headers, cookies and challenge markup — no account, nothing uploaded.