Modsecurity rules integration in Varnish (feature)

We've integrated hundreds of modsecurity rules into the VCL (security.vcl) that ships out with the plugin. These rules defend against all sorts of SQL injection, file injection, XSS attacks, etc. security.vcl goes step further and includes rules found in Web application firewalls. This adds an extra layer of protection for your websites right into Varnish and in memory for faster processing (modsecurity in Apache tends to slow things down a bit). You can review the rules in /etc/varnish/security and /etc/varnish/security.vcl (entry point). This feature is disabled by default and needs to be enabled for the rules to take effect (one-click enable in WHM).
  • 8 Users Found This Useful
Was this answer helpful?

Related Articles

Stop worpress wp-login.php brute force attacks with Varnish throttling (Rate Limit)

Version 1.8.4 of the cPanel Varnish Plugin has seen a new feature being introduced: the ability...

Varnish Plugin on Amazon AWS with Elastic IP or NAT

Here are the two short steps required to ensure licensing is setup properly so you're able to use...

Correct IP reporting in legacy software / scripts

The plugin follows reverse proxy software proper handling of X-Forwarded-For headers and in this...

vBulletin correct reporting of IP address

It's recommended to make the following changes to includes/config.php so vB doesn't report...

Powered by WHMCompleteSolution