I've added this to my vhost.conf



Ran this command:



Still getting FP's on both rules. Disabled ASL Core rules just to try to get the site to work. Any suggestions?

Are you just running the rules, or ASL?

If you are just running the rules, where you call this in Apaches configuration and how you call it matters a lot.

First I'd remove the if statements, you dont need them. Second, if you add LocationMatch in the wrong part of apaches config it wont work. You need to make sure you at a point in the vhosts declaration where you can call those statements. Where did you place that in your vhosts declaration?

If you are running ASL, just log into the GUI, pull up the rule manager and tell it to ignore those rules for those vhosts and you are all done.

Cool Mike! Was that there before 3.0? Previous disable instructions I had read were to put it in vhost.

I always use the IfModule check. In case I want to debug something and try to just not load mod_security, it's very handy that Apache will still start.

Thats correct, 3.0 has a rule manager you can use to do this.