# Discourse + Web Application Firewall (WAF) mod\_security **URL:** \ **Category:** Self-hosting\ **Tags:** unsupported-install, hosting\ **Created:** [November 17, 2019, 1:37pm UTC](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612 "2019-11-17T13:37:55Z")\ **Posts on this page:** 1\ **Showing post:** 8
**Author:** ![RGJ](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/rgj/32/523185_2.png) [@RGJ](https://meta.discourse.org/u/RGJ)\ **Post date:** [November 18, 2019, 4:47pm UTC](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612/8 "2019-11-18T16:47:20Z")
I do agree with you that ModSecurity or similar WAFs are not a golden bullet. But I know (at least?) [one vulnerability that was found in RoR which affected Discourse](https://nvd.nist.gov/vuln/detail/CVE-2019-5418) that would have been mitigated by a ModSecurity-like mechanism. When we were patching this we saw in our logs that it had been used in the wild on at least one of our forums before the CVE was publicly known and patched. This did not result in any information disclosure but that was _only_ because we did some things differently from a [standard install](https://meta.discourse.org/t/142537?silent=true) (i.e. luck). I’m not sure if the added complexity outweighs the added security though. --- _[View the full topic](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612)._