title: Downsides to whitelisting localhost in mod_security?
body: <p>I've just enabled mod_security on my CentOS server via WHM with OWASP ModSecurity Core Rule Set.</p>
  
  <p>I've seen some very useful stuff so far but also some very annoying, not very useful things such as:</p>
  
  <pre><code>016-06-23 10:00:01      127.0.0.1   WARNING 200  960008: Request Missing a Host Header
  
  2016-06-23 10:00:01     127.0.0.1   NOTICE  200  960009: Request Missing a User Agent Header  More
  
  2016-06-23 10:00:01     127.0.0.1       200  981204: Inbound Anomaly Score Exceeded (Total Inbound Score: 5): Request Missing a User Agent Header
  </code></pre>
  
  <p>Basically 95% of the hits (which are a lot) are like this, form localhost.</p>
  
  <p>What is this exactly? And are there security concerns should I simply whitelist localhost?</p>
  
  <p>Thanks</p>