Disabling Mod_Security

[donwon]

Do any of you totally disable mod-security for your XF forums?

We've been having issues on our new server and I think this is somewhat to blame. On our old server we had is totally disabled but our host is strongly advising against it.

Thoughts?

 

[djbaxter]

I've never enabled mod_security on any of my sites, forums or otherwise.

 

[donwon]

You've never worried about SQL injections?

 

[djbaxter]

I worry about everything but I have other security measures in place and I am very vigilant about updating my server and all applications that run on my server.

 

[donwon]

Anyone else?

 

[sbj]

I believe XF uses the finder system, which makes it secure against sql injections. However addons might use direct queries, which could be exploited potentially, if they don't use the finder system instead of direct queries.

I also believe many people disable mod security. But if you are unsure of it, either change your hosting company or live with it if you don't want to disable it.

A simple search shows that many peope disable it.

 

[m1ne]

I use them via CloudFlare.

 

[Nirjonadda]

I have enabled mod_security with COMODO ModSecurity Apache Rule Set. Also disabled some ModSecurity™ rules because false block.