Is mod_security a good thing?
<p>I've recently been frequented by erroneous error messages from mod_security. Its filter sets cover outdated PHP exploits, and I have to rewrite my stuff because Wordpress&amp;Co had bugs years ago.  </p>

<p>Does this happen to anyone else?</p>

<blockquote>
  <p>Apache mod_security blocks possibly
  dangerous HTTP requests before they
  reach applications (PHP specifically).
  It uses various filter sets, mostly
  regex based.</p>
</blockquote>

<p>So I have a nice shared hosting provider, technically apt and stuff. But this bugged me:</p>

<p>Just last week I had to change a parameter name <code>&amp;src=</code> in one of my apps because mod_security blocks ANY requests with that. I didn't look up its details, but this filter rule was preventing the exploitability of another app which I don't use and probably never had heard about. Still I had to rewrite <em>my code</em> (renaming parameter often suffices to trick mod_security) which had nothing to do or in common with that!</p>

<p>And today, a silly regex blocks form submissions, because I wanted to submit php sample code. Given, this is the simple stuff that mod_security is there to protect against. But I don't believe mod_security can detect seriously obfuscated code, and just goes off at obvious (and in this case totally trivial) php snippets.</p>

<p>Basically I'm getting penalized by mod_security because other people released bug-prone apps. (Not saying my apps are ultra secure - I'm pretty security wary, but make no hyperbolic claims.)<br>
I've already asked my provider to disable it anyway, the benefits are too minuscle IMO and for my apps.</p>

<hr>

<p>What do you think? Does mod_security make much sense outside of WP hosting? Or is it really just a bunch of blacklists of long passed security bugs? Which of its rules are actually helpful? Is there an application level equivalent?</p>
