How to Secure Nginx with NAXSI on Ubuntu 16.04?

Updated: 28 September 2026 · Applies to: Ubuntu 24.04 (Nginx with ModSecurity v3 and OWASP CRS)

Ubuntu 16.04 is end of life. NAXSI, a web application firewall module for Nginx, is no longer packaged for current Ubuntu, and its original project was archived in 2023 (a community fork continues). On Ubuntu 24.04 the packaged choice is ModSecurity v3 with the OWASP Core Rule Set (CRS).

Install ModSecurity for Nginx

apt install nginx libnginx-mod-http-modsecurity modsecurity-crs

Enable it

The Nginx module package ships the engine settings in /etc/nginx/modsecurity.conf, a file that loads them together with the CRS rules (/etc/nginx/modsecurity_includes.conf), and an example site in /etc/nginx/sites-available/default-modsecurity.conf. Use the example as a model:

1. In /etc/nginx/modsecurity.conf, check that SecRuleEngine is DetectionOnly to start with: requests are then logged but not blocked.
2. In your site's server block add modsecurity on; and modsecurity_rules_file /etc/nginx/modsecurity_includes.conf; (compare with the example site).
3. Test and reload: nginx -t && systemctl reload nginx.

Tune, then block

Use the site normally for a few days and read the audit log (its path is set by SecAuditLog in modsecurity.conf). The CRS includes exclusion packages for WordPress, Drupal, Nextcloud and others, which you can enable in /etc/modsecurity/crs/crs-setup.conf. Exclude rules that block legitimate requests, then set SecRuleEngine On to start blocking.

Tip: Test with a harmless attack pattern: curl "https://example.com/?q=<script>alert(1)</script>" should be logged (and blocked with 403 once blocking is on).