Take the 2-minute tour ×

I have a directory/site set-up like this on my Apache/2.2.19 (Win32) Server using mod_security + core ruleset/2.2.1


In my modsecurity_crs_10_config.conf I have


The problem is that it won't work unless I type in the full path for each of the login.php pages, like so:

setvar:'tx.brute_force_protected_urls=/website1/login.php /website2/login.php andSoOn'

I have tried other ways with RegEx to work around it (e.g. /(.*)/login.php) but I can't seem to get it.

So, question is basically; how do you enforce BFP on all pages called login.php on the server?


share|improve this question
add comment

2 Answers

Try this:


If it doesn't work, I suggest you enabling debug to see what the logs say.

share|improve this answer
I can't see anything of interest in the log, just says it's checking against the url (/login.php) and does not return with a valid hit. I was trying to use .htaccess to configure, which would make life easier, but it won't work with v2 for security reasons. –  PadraigD Sep 8 '11 at 10:15
When code setvar:tx.brute_force_protected_urls=/login.php code the log states code Warning. Match of "within %{tx.brute_force_protected_urls}" against "REQUEST_FILENAME" required code –  PadraigD Sep 8 '11 at 10:51
add comment
up vote 0 down vote accepted

I got it working. In 'modsecurity_crs_11_brute_force.conf' I had to change line 39:

SecRule REQUEST_FILENAME "!@within %{tx.brute_force_protected_urls}"  ...


SecRule REQUEST_FILENAME "!@contains %{tx.brute_force_protected_urls}" ...

and in 'modsecurity_crs_10_config.conf', have:

setvar:'tx.brute_force_protected_urls=/login.php' ...

Thanks for the help.

share|improve this answer
add comment

Your Answer


