Web Application Firewall Setup: OWASP Top 10, ModSecurity, Cloudflare

Is a SQL injection in production killing your website? Or an XSS attack bypassing front-end validation? We know how to stop it. We set up WAF from scratch: from cloud Cloudflare to self-hosted ModSecurity with OWASP CRS. No guesswork—only an engineering approach and experience from over 500 successful cases. Contact us—we'll help you choose the optimal configuration.

Why WAF is important for protecting against automated attacks?

Automated scanners and botnets attack hundreds of entry points simultaneously. WAF analyzes each HTTP request in real time and blocks known patterns: SQLi, XSS, LFI, SSRF, mass directory scanning. It works at L7, in front of your web server or application. The difference is clear: without WAF you rely only on application code—with WAF you get a second defense line that doesn't require code changes. According to OWASP Top Ten, web application attacks remain a critical threat.

How to choose the right type of WAF?

The choice between cloud and self-hosted WAF depends on three factors: compliance, budget, and expertise. Cloud solutions (Cloudflare, AWS WAF) are faster to deploy and don't require server management. Self-hosted (ModSecurity, Coraza, BunkerWeb) give full control over rules and data. We compare both approaches:

How we configure ModSecurity + OWASP CRS: a practical case

Recently, a client with a high-load e-commerce site faced massive XSS attacks through review fields. Standard front-end validation didn't help—attackers bypassed it by spoofing MIME types. We deployed ModSecurity on Nginx with OWASP CRS and reduced false positives to zero within two weeks.

Installation on Ubuntu/Debian:

apt install libnginx-mod-security2 

Nginx configuration:

modsecurity on;
modsecurity_rules_file /etc/nginx/modsecurity/modsecurity.conf;
server {
    listen 443 ssl;
    modsecurity on;
    modsecurity_rules_file /etc/nginx/modsecurity/main.conf;
}

modsecurity.conf file:

SecRuleEngine On # DetectionOnly for initial logging
SecRequestBodyAccess On
SecResponseBodyAccess Off # Enable only if response checking is needed
SecAuditEngine RelevantOnly
SecAuditLog /var/log/modsecurity/audit.log

Then we connected OWASP CRS:

git clone https://github.com/coreruleset/coreruleset /etc/nginx/modsecurity/crs
# main.conf
Include /etc/nginx/modsecurity/modsecurity.conf
Include /etc/nginx/modsecurity/crs/crs-setup.conf
Include /etc/nginx/modsecurity/crs/rules/*.conf

Setting the paranoia level:

SecAction \ "id:900000, \ phase:1, \ nolog, \ pass, \ t:none, \ setvar:tx.paranoia_level=2" 

For the first two weeks we worked in DetectionOnly mode, analyzed audit.log, and created exceptions by URI. We blocked 98% of attacks without a single user complaint. False positives dropped by 60% after configuring exceptions.

How to deal with false positives?

False positives are the main pain after WAF installation. We use a multi-stage approach: first enable DetectionOnly for 1–2 weeks, analyze audit.log, then create exceptions by rule and URI. OWASP CRS paranoia levels (1–4) allow flexible sensitivity tuning. Our experience shows that after two weeks of fine-tuning, false positives drop to 5% of the initial level.

How to estimate the cost of WAF implementation?

Implementation cost consists of engineer time and chosen solution. Cloud WAF takes 4–8 hours to configure, self-hosted takes 3–5 days. Cloud solutions are usually cheaper upfront, but with traffic growth, the subscription cost may exceed the cost of your own server. Self-hosted requires investment in server hardware and ModSecurity licenses (free) or commercial support.

What is included in the work

• Audit of current traffic and vulnerabilities
• Selection of the appropriate WAF type (cloud or self-hosted)
• Installation and initial rule configuration
• False positive analysis for 1–2 weeks
• Fine-tuning of exceptions and paranoia levels
• Monitoring via SIEM or provider dashboards
• Operation and support documentation

Implementation timelines

• Cloudflare WAF with managed rules: 4–8 hours
• ModSecurity + OWASP CRS + exceptions: 3–5 days
• AWS WAF via Terraform + monitoring: 2–3 days

Monitoring and alerts

ModSecurity logs are parsed via GoAccess or Filebeat into Elasticsearch. Cloud WAFs have built-in dashboards: Cloudflare Security Events, AWS WAF sampled requests. An alert on a sharp increase in blocks indicates an ongoing attack or a broken application. We configure notifications to Telegram or Slack as part of support.

Order a security audit for your web application—we'll assess current risks and suggest an optimal WAF configuration. Get a consultation on protection against OWASP Top 10.