WAF and DDoS/Bot prevention engine

SecRule VARIABLES OPERATOR [TRANSFORMATION_FUNCTIONS, ACTIONS]

# Block further login attempts after 3 failed attempts



# Initalize IP collection with user's IP address

SecAction "initcol:ip=%{REMOTE_ADDR},pass,nolog"



# Detect failed login attempts

SecRule RESPONSE_BODY "Unauthorized" "phase:4,pass,setvar:ip.failed_logins=+1,expirevar:ip.failed_logins=60"



# Block subsequent login attempts

SecRule IP:FAILED_LOGINS "@gt 2" deny

SecDefaultAction "phase:2,log,auditlog,deny,status:403"

SecRule ARGS "(select|create|rename|truncate|load|alter|delete|update|insert|desc)\s*" "t:lowercase,msg:'SQL Injection'"