ModSecurity and the OWASP CRS — the WAF rules we actually ship on Apache

Most ModSecurity installs are either off by default or so noisy nobody reads the logs. Here’s how we tune it to be useful without drowning…