LogoفارسیFA

ModSecurity 3 and NGINX Standalone in cPanel & WHM

This article explains how ModSecurity 3 works in cPanel & WHM, how to install and configure it for Apache or NGINX, key differences from ModSecurity 2, and how to use the experimental NGINX Standalone web server. It includes configuration paths, warnings, and compatibility notes for production environments.

ModSecurity 3, NGINX StandalonecPanel WHM, OWASP CRS, WAFEasyApache 4, Apache, NGINX

~3 min read • Updated Feb 20, 2026

1. What Is ModSecurity 3?


ModSecurity 3 is a powerful open-source Web Application Firewall (WAF) designed to protect servers against common web attacks such as SQL Injection, XSS, RCE, and more.


Key differences from ModSecurity 2:

  • ModSecurity 3 is no longer an Apache module — it is a standalone library.
  • It requires a connector (Apache or NGINX) to function.
  • Supports OWASP Core Rule Set (CRS).
  • It is experimental and requires the Experimental Repository.

Compatibility:

  • Works with both Apache and NGINX.
  • Available in cPanel & WHM version 112 and above.


2. Installing ModSecurity 3


Method 1 – Install via WHM (Recommended)

Navigate to:

WHM → Home → Software → EasyApache 4

Under Customize, choose:

  • Apache Modules or NGINX Modules

Install the following packages:

  • ea-modsec30-connector-nginx — for NGINX
  • ea-modsec30-connector-apache24 — for Apache
  • ea-modsec30-rules-owasp-crs — OWASP CRS ruleset

Click Provision.


Method 2 – Install via Command Line

# NGINX
yum install ea-modsec30-connector-nginx

# Apache
yum install ea-modsec30-connector-apache24

# OWASP CRS (required for both)
yum install ea-modsec30-rules-owasp-crs


3. ModSecurity 3 Configuration Files


If Using NGINX

PathDescription
/etc/nginx/conf.d/modsec30.confDefault config + includes for cPanel and user configs
/etc/nginx/conf.d/modsec/modsec30.cpanel.confRules and settings defined via WHM/cPanel
/etc/nginx/conf.d/modsec/modsec30.user.confUser-level manual overrides (edit with caution)
/etc/nginx/conf.d/modsec_vendor_configs/Vendor (third‑party) rule sets
/var/log/nginx/modsec30_audit/ModSecurity audit logs (Concurrent Logging)

If Using Apache

PathDescription
/etc/apache24/conf.d/modsec30.confDefault config + includes
/etc/apache2/conf.d/modsec2.cpanel.confcPanel-generated rules (name kept for compatibility)
/etc/apache2/conf.d/modsec/modsec2.user.confUser-level manual overrides
/etc/apache2/logs/modsec_audit/Audit logs (Concurrent or Serial depending on MPM)

Warning: Only edit user.conf files if absolutely necessary — incorrect rules may break websites.



4. Key Differences Between ModSecurity 2 and ModSecurity 3


Feature ModSecurity 2 ModSecurity 3 (NGINX) Notes
SecDataDir Supported Not supported —
SecConnEngine Supported Not supported —
SecDisableBackendCompression Supported Not supported —
SecGsbLookupDb Supported Not supported —
SecGuardianLog Supported Not supported —
Response Code Usually 403 Sometimes 406 NGINX behavior differs


5. NGINX Standalone (Legacy Experimental Feature)


NGINX Standalone replaces Apache as the primary web server. Apache is moved to ports 81 (HTTP) and 444 (HTTPS). Static content is served directly by NGINX, while dynamic content (PHP, etc.) is proxied to Apache.


Requirements

  • EasyApache 4
  • Experimental Repository:
    yum install ea4-experimental
  • PHP-FPM enabled
  • ea-ruby27-mod_passenger for Passenger apps

Install

yum --enablerepo=EA4-experimental install ea-nginx-standalone

Uninstall

yum erase ea-nginx-standalone

Important Changes After Installation

  • Apache ports: 81 (HTTP) and 444 (SSL)
  • Main NGINX config: /etc/nginx/conf.d/ea-nginx.conf
  • Logs: /var/log/nginx/domains/domain.com and domain.com-ssl_log
  • Dynamic content proxied to Apache

Limitations

  • WordPress Pretty Permalinks do not work without custom NGINX rules.
  • .htaccess is not supported — must be rewritten in NGINX syntax.
  • WordPress Multisite is not supported.


Conclusion


ModSecurity 3 provides a modern, flexible WAF solution for both Apache and NGINX in cPanel & WHM, but it remains experimental and requires careful configuration. NGINX Standalone offers performance benefits but comes with significant limitations. Understanding these components helps administrators deploy secure and optimized hosting environments.


Written & researched by Dr. Shahin Siami

Next Article