ModSecurity filters HTTP traffic against rule sets that recognise SQL injection, XSS, exploit probes and scanner behaviour, logging an “Access denied” entry whenever a rule fires.
Those denial logs are valuable raw material: aggregated by IP they reveal who attacks which site and how persistently — feeding attacker dashboards and auto-blocking. Its false-positive side matters too: an overzealous rule can block a legitimate user’s form post, which is why review-then-block beats blind automation.
Frequently asked questions
Does ModSecurity slow my sites down?
Slightly — every request is inspected — but on typical hosting workloads the overhead is small compared to PHP and database time.
A legitimate user is blocked by a rule — what now?
Find the rule ID in the audit log and whitelist that rule for the affected site (or adjust the rule), rather than disabling the WAF entirely.