# Discourse + Web Application Firewall (WAF) mod\_security **URL:** \ **Category:** Self-hosting\ **Tags:** unsupported-install, hosting\ **Created:** [November 17, 2019, 1:37pm UTC](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612 "2019-11-17T13:37:55Z")\ **Posts on this page:** 1\ **Showing post:** 9
**Author:** ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)\ **Post date:** [November 20, 2019, 11:07pm UTC](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612/9 "2019-11-20T23:07:20Z")
I liken WAFs to signature-based virus scanners which IMO are not very useful in environments with a limited attack surface (e.g. your non-Windows servers) They’re not going to catch everything but they will (in theory) catch common patterns of attacks (e.g. SQLI) and known exploits (e.g. the RoR vuln above) across a range of software. I can see the value of running them especially in an environment (enterprise) where you have a ton of applications running god-knows-what and you need to know you’re protecting each application from these exploits without needing to worry about every individual one - that takes an NxM size problem and reduces it to N+M Whether or not it’s worth running on your site is a different matter and one of those risk (of breakage)-benefit (of protection) analyses you’ll need to do for yourself. --- _[View the full topic](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612)._