I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all?
What would be the recommended packages to use? I want to mostly block bad UA, SQL and XSS attacks.
I was looking at all the owasp rules for mod_security. How badly does it slow your loading time down if you use them all?
What would be the recommended packages to use? I want to mostly block bad UA, SQL and XSS attacks.
I went through adding the rules from the Core Rule Set in one at a time and watching closely for false positives. Plenty of the SQL and XSS rules cause false positives, depending on what your URLs look like.
As for slowing down the page loads, the audit log has timing information but I've not yet seen a whole millisecond caused by mod_security. I wouldn't worry too much about that.
As John said, both of these result may be different on your systems with your website.