Well, I'm not sure if I'd suggest looking at mod_security in a 'straightforward' manner particularly. Doing so will likely get you frustrated with the interacti

Well, I'm not sure if I'd suggest looking at mod_security in a 'straightforward' manner particularly. Doing so will likely get you frustrated with the interaction you are likely to have with any default rule-set. A good way to look at it is to start by installing it and a good rule-set. A good one could be the gotroot/ASL kit http://updates.atomicorp.com/channels/rules/ http://updates.atomicorp.com/channels/rules/ From that point your best bet would perhaps be one of the freely available 'getting started' guides like https://www.feistyduck.com/books/modsecurity-handbook/gettingStarted.html https://www.feistyduck.com/books/modsecurity-handbook/gettin... Mostly though, my suggestion is to deploy it, have your application break (you should be doing this all in a staging environment), figure out if unbreaking your application can be done with scripting changes, bypassing rules, etc.