# ------------------------------------------------------ # Imunify360 ModSecurity Rules # Copyright (C) 2026 CloudLinux Inc All right reserved # The Imunify360 ModSecurity Rules is distributed under # IMUNIFY360 LICENSE AGREEMENT # ------------------------------------------------------ # Imunify360 ModSecurity Base Ruleset SecRule REQUEST_METHOD "!@rx ^POST$" "id:77316866,phase:2,pass,severity:5,t:none,nolog,skipAfter:MARKER_SPAM_POST,tag:'noshow'" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142125,chain,pass,nolog,auditlog,t:none,severity:5,msg:'IM360 WAF: Track WordPress registration flood||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'wp_core'" SecRule REQUEST_URI "@contains wp-login.php" "chain,t:none" SecRule ARGS:action "@contains register" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142125" SecRule REQUEST_METHOD "@streq POST" "id:33309,chain,phase:2,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Tracking WordPress comments||AUTH:%{ARGS.author}||RSV:8.02||T:APACHE||MAIL:%{ARGS.email}||MTD:%{tx.0}||',tag:'service_im360',tag:'noshow'" SecRule REQUEST_FILENAME "@endsWith wp-comments-post.php" "chain,t:none" SecRule ARGS:author "!@rx ^$" "chain,t:none" SecRule ARGS:email "!@rx ^$" "chain,t:none" SecRule ARGS:comment "!@rx ^$" "t:none,capture,t:sha1,t:hexEncode,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r33309" SecRule REQUEST_METHOD "@rx ^POST$" "chain,phase:2,id:33319,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Tracking Joomla contact message||RSV:8.02||T:APACHE||',tag:'service_im360',tag:'noshow'" SecRule ARGS:Itemid|ARGS:id "@rx \d+" "chain,t:none" SecRule ARGS:option "@streq com_contact" "chain,t:none" SecRule ARGS:task|ARGS:view "@contains contact" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r33319" SecRule REQUEST_METHOD "@rx ^POST$" "chain,id:77888097,phase:2,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Track Joomla registration||EMAIL:%{TX.0}||RSV:8.02||T:APACHE||',tag:'service_im360',tag:'noshow'" SecRule ARGS:jform[email1] "@rx ." "t:none,capture,setvar:tx.t_JFE=%{tx.0}" SecRule REQUEST_METHOD "@rx ^POST$" "chain,id:77888098,phase:2,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Track Joomla registration||UNAME:%{TX.0}||RSV:8.02||T:APACHE||',tag:'service_im360',tag:'noshow'" SecRule ARGS:jform[user_name] "@rx ." "t:none,capture,setvar:tx.t_JFUN=%{tx.0}" SecRule REQUEST_METHOD "@rx ^POST$" "id:33321,chain,phase:2,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Track Joomla registration||AUTH:%{tx.t_JFUN}||MAIL:%{tx.t_JFE}||RSV:8.02||T:APACHE||',tag:'service_im360',tag:'noshow'" SecRule REQUEST_URI "@pm index.php /component/users/" "chain,t:none,t:normalizePath" SecRule ARGS:task|ARGS:view "@rx (?:^registration|user\.login)" "chain,t:none" SecRule ARGS:option "@streq com_users" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r33321" SecRule REQUEST_FILENAME "@rx class\.phpmailer\.php" "id:33323,chain,phase:2,pass,nolog,auditlog,severity:5,t:none,t:urlDecodeUni,t:normalizePath,t:lowercase,msg:'IM360 WAF: Track Joomla contact form spam||RSV:8.02||T:APACHE||',tag:'service_im360',tag:'noshow'" SecRule REQUEST_METHOD "@rx ^POST$" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r33323" SecRule REQUEST_COOKIES:/PrestaShop/ "!@rx ^$" "id:77140777,chain,block,nolog,auditlog,severity:2,t:none,msg:'IM360 WAF: Block spam Customer Account in PrestaShop||MVN:%{MATCHED_VAR_NAME}||RSV:8.02||T:APACHE||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule ARGS:lastname|ARGS:firstname "@pm www http" "t:none,t:lowercase,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77140777" SecRule REQUEST_COOKIES:/PrestaShop/ "!@rx ^$" "id:77140778,chain,pass,severity:2,t:none,msg:'IM360 WAF: Track spam Customer Account in PrestaShop||MVN:%{MATCHED_VAR_NAME}||RSV:8.02||T:APACHE||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule ARGS:lastname|ARGS:firstname "!@rx ^[^0-9!\[\]<>,;?=+()@#\"{}_$%:\/\\\*\^]*$" "t:none,t:urlDecode,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77140778" SecRule REQUEST_URI|ARGS_NAMES|ARGS:submit|ARGS:jtxf "@rx (Post\sComment|v2\/comments[^\/]{0,108}content|comment_body\[|JCommentsAddComment)" "id:77140835,phase:request,auditlog,pass,severity:5,t:none,t:normalizePath,msg:'IM360 WAF: Block Drupal/Joomla spammers||MVN:%{MATCHED_VAR_NAME}||RSV:8.02||T:APACHE||MV:WP_DRUPAL_JOOMLA_COMMENT||',tag:'service_im360',chain" SecRule &TX:rbl_whitelist_check "@eq 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77140835" SecRule REQUEST_URI|ARGS_NAMES|ARGS:submit|ARGS:jtxf "@rx (Post\sComment|v2\/comments[^\/]{0,108}content|comment_body\[|JCommentsAddComment)" "id:77140736,phase:request,pass,nolog,auditlog,severity:5,t:none,t:urlDecodeUni,t:normalizePath,msg:'IM360 WAF: WP/DRUPAL/JOOMLA comments analysis||MVN:%{MATCHED_VAR_NAME}||RSV:8.02||T:APACHE||MV:WP_DRUPAL_JOOMLA_COMMENT||',setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77140736,tag:'service_im360',tag:'noshow'" SecRule REQUEST_URI "@rx \/\.index\.php\/component\/users\/" "chain,id:77141080,t:none,t:urlDecodeUni,t:normalizePath,msg:'IM360 WAF: Joomla! spam detection||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||RSV:8.02||T:APACHE||',phase:2,pass,nolog,auditlog,t:none,severity:2,tag:'joomla_core'" SecRule ARGS:task "@streq user.login" "chain,t:none,t:urlDecodeUni" SecRule REQUEST_HEADERS:Referer "@rx \/component\/users\/\?view=login" "t:none,t:normalizePath,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77141080" SecRule REQUEST_METHOD "@rx ^POST$" "id:77141093,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam via admin-ajax.php||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'wp_core'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_FILENAME "@endsWith /wp-admin/admin-ajax.php" "chain,t:none,t:normalizePath" SecRule &REQUEST_HEADERS:Referer "@eq 0" "chain,t:none" SecRule &REQUEST_HEADERS:User-Agent "@eq 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77141093" SecRule REQUEST_METHOD "@rx ^POST$" "id:77141094,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam in PrestaShop||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_FILENAME "@endsWith /sendtoafriend_ajax.php" "t:none,t:normalizePath,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77141094" SecRule REQUEST_METHOD "@rx ^POST$" "id:77141095,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam in PrestaShop||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_FILENAME "@pm /contact /contattaci /component/jcomments/" "t:none,t:normalizePath,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77141095" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142097,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam via contactform for WordPress||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'wp_core'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_URI "@rx \/wp-json\/contact-form-7\/v\d\/contact-forms\/\d{1,3}\/feedback" "t:none,t:normalizePath,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142097" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142098,chain,pass,nolog,auditlog,t:none,severity:5,msg:'IM360 WAF: Track spam in Joomla virtuemart||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_FILENAME "@contains /index.php" "chain,t:none" SecRule ARGS:page "@contains shop." "chain,t:none" SecRule ARGS:option "@streq com_virtuemart" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142098" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142113,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam PrestaShop||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule ARGS:controller "@contains contact" "chain,t:none" SecRule ARGS:id_contact "!@rx ^$" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142113" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142135,chain,pass,nolog,auditlog,t:none,severity:5,msg:'IM360 WAF: Track spam PrestaShop||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'service_im360',tag:'noshow'" SecRule ARGS:controller "@contains contact" "chain,t:none" SecRule ARGS:id_contact "@rx \d+" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142135" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142114,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam in Joomla admin page||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_FILENAME "@contains /administrator/index.php" "chain,t:none,t:normalizePath" SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142114" SecRule REQUEST_METHOD "@pm POST GET" "id:77142136,chain,pass,nolog,auditlog,phase:5,t:none,severity:5,msg:'IM360 WAF: [RBL] Track spam in Magento||RSV:8.02||T:APACHE||MV:%{MATCHED_VAR}||',tag:'service_im360',tag:'noshow'" SecRule REQUEST_URI "@contains /customer/account/create" "t:none,t:normalizePath,setvar:'tx.rbl_infectors_rule=%{tx.rbl_infectors_rule}r77142136'" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142137,chain,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Track WordPress registration flood||RSV:8.02||T:APACHE||',tag:'wp_core',tag:'noshow'" SecRule REQUEST_URI "@contains wp-login.php" "chain,t:none" SecRule ARGS:action "@contains register" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142137" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142134,chain,pass,nolog,auditlog,t:none,severity:5,msg:'IM360 WAF: Track spam in Joomla virtuemart||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core',tag:'noshow'" SecRule REQUEST_FILENAME "@contains /index.php" "chain,t:none,t:normalizePath" SecRule ARGS:page "@contains shop." "chain,t:none" SecRule ARGS:option "@streq com_virtuemart" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142134" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142188,chain,phase:2,pass,nolog,auditlog,severity:5,t:none,msg:'IM360 WAF: Track spam via newsletter||MVN:%{MATCHED_VAR_NAME}||RSV:8.02||T:APACHE||MV:%{MATCHED_VAR}||',tag:'service_im360',tag:'noshow'" SecRule REQUEST_FILENAME "@contains /newsletter/subscriber/new/" "chain,t:none,t:normalizePath" SecRule &ARGS:email "@gt 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142188" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142191,chain,pass,t:none,severity:2,msg:'IM360 WAF: Track spam in PrestaShop||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule REQUEST_FILENAME "@endsWith /sendtoafriend_ajax.php" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142191" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142192,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam attempts||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'service_im360',tag:'noshow'" SecRule REQUEST_FILENAME "@pm /contact /contattaci /component/jcomments/" "t:none,t:normalizePath,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142192" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142193,chain,pass,t:none,severity:2,msg:'IM360 WAF: Track spam in Joomla admin page||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core'" SecRule REQUEST_FILENAME "@contains /administrator/index.php" "chain,t:none,t:urlDecodeUni,t:normalizePath" SecRule &REQUEST_HEADERS:Referer "@eq 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142193" SecRule REQUEST_METHOD "@rx ^POST$" "id:77142221,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam via Avia Layaut Builder generated forms||RSV:8.02||T:APACHE||MV:%{MATCHED_VAR}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule ARGS_NAMES "@rx avia_\d" "chain,t:none" SecRule ARGS_NAMES "@rx avia_generated_form" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142221" SecRule REQUEST_METHOD "@streq post" "chain,id:77142238,pass,nolog,auditlog,phase:2,severity:5,t:none,t:lowercase,msg:'IM360 WAF: Spam tracking via contact form||RSV:8.02||T:APACHE||E-mail=%{ARGS.wb_input_1}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" "chain,t:none,t:lowercase" SecRule REQUEST_FILENAME "@contains contact" "chain,t:none" SecRule &ARGS:wb_input_1 "@gt 0" "chain,t:none" SecRule &ARGS:wb_input_2 "@gt 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142238" SecRule REQUEST_METHOD "@streq POST" "chain,id:77142239,pass,nolog,auditlog,phase:2,severity:5,t:none,msg:'IM360 WAF: Spam tracking via contact form||RSV:8.02||T:APACHE||E-mail=%{ARGS.field_1}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_FILENAME "@contains contact" "chain,t:none" SecRule &ARGS:field_1 "@gt 0" "chain,t:none" SecRule &ARGS:field_2 "@gt 0" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77142239" SecRule REQUEST_METHOD "@streq post" "chain,id:77142240,pass,nolog,auditlog,phase:2,severity:5,t:none,t:lowercase,msg:'IM360 WAF: Spam tracking via contact form||RSV:8.02||T:APACHE||E-mail=%{tx._F51e}||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule REQUEST_HEADERS:Content-Type "@contains multipart/form-data" "chain,t:none,t:lowercase" SecRule REQUEST_FILENAME "@contains /component/com_redform" "chain,t:none,t:normalizePath" SecRule ARGS:field5.1[email] "@rx ." "t:none,capture,setvar:tx._F51e=%{TX.0}" SecRule REQUEST_METHOD "@rx ^POST$" "id:77316718,chain,pass,t:none,severity:5,msg:'IM360 WAF: Track spam in Joomla||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core',tag:'noshow'" SecRule ARGS:option "@contains com_rscomments" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77316718" SecRule REQUEST_METHOD "@rx ^POST$" "id:77316719,chain,pass,nolog,auditlog,t:none,severity:5,msg:'IM360 WAF: Track spam in Joomla||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule ARGS:option "@contains com_rscomments" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77316719" SecRule REQUEST_METHOD "@rx ^POST$" "id:77316721,chain,pass,nolog,auditlog,t:none,severity:5,msg:'IM360 WAF: Track spam in Joomla||RSV:8.02||T:APACHE||MVN:%{MATCHED_VAR_NAME}||MV:%{MATCHED_VAR}||',tag:'joomla_core'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule ARGS:controller "@contains com_contact" "t:none,setvar:tx.rbl_web_spammers_rule=%{tx.rbl_web_spammers_rule}r77316721" SecRule TX:rbl_web_spammers_rule "!@rx ^$" "chain,id:77316905,block,nolog,auditlog,severity:2,setvar:tx.rbl_perf=1,msg:'IM360 WAF: Block IP which is in the web-spammers RBL||Rules:%{tx.rbl_web_spammers_rule}||MV:%{MATCHED_VAR}||RSV:8.02||T:APACHE||',tag:'service_im360'" SecRule &TX:rbl_whitelist_check "@eq 0" "chain,t:none" SecRule TX:RBL_IP "@rbl web-spammers.v2.rbl.imunify.com." "chain,t:none" SecRule TX:RBL_IP "!@rbl nxdomain.v2.rbl.imunify.com." "t:none" SecRule TX:rbl_web_spammers_rule "!@rx ^$" "chain,id:77316904,pass,nolog,auditlog,severity:5,setvar:tx.rbl_perf=1,msg:'IM360 WAF: Track IP which is in the web-spammers RBL||Rules:%{tx.rbl_web_spammers_rule}||MV:%{MATCHED_VAR}||RSV:8.02||T:APACHE||',tag:'service_im360'" SecRule TX:RBL_IP "@rbl web-spammers.v2.rbl.imunify.com." "chain,t:none" SecRule TX:RBL_IP "!@rbl nxdomain.v2.rbl.imunify.com." "t:none" SecMarker MARKER_SPAM_POST