mod-security: warning, not blocking

Question

I've installed mod-security and can see from the logs that it is warning me in the case of an SQLi attempt. The attempt succeeds however, when I expect it to be prevented. Clearly I'm missing some very obvious setting, but I can't find it!

Any help appreciated.

Answer 1

Did you set

SecRuleEngine On

in "modsecurity.conf"? The default is

SecRuleEngine DetectionOnly

Also see https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#SecRuleEngine