Directives

This section contains the rule directives supported by WGE. Among these, only SecRule and SecAction are runtime directives; all others are configuration-phase directives that take effect immediately upon parsing. For directives like SecRuleRemoveById that modify the state of specific rules, they must be loaded after the corresponding rules.

Some directives are not implemented in WGE. Most of these can be parsed normally by WGE (such as SecArgumentSeparator), but their functionality is not implemented - this will not cause crashes or errors. All subpages will indicate whether a directive is implemented; please check before use.

Additionally, WGE has added some directives not present in ModSecurity (such as SecRuleUpdateOperatorById) for more convenient usage.

KeywordDescription
IncludeInclude an external configuration file into the current configuration
SecActionUnconditionally execute the specified actions
SecArgumentSeparatorSpecify the parameter separator character
SecArgumentsLimitConfigure the maximum number of acceptable parameters
SecAuditEngineConfigure the audit logging engine
SecAuditLogConfigure the path to the primary audit log file
SecAuditLog2Configure the path to the secondary audit log file
SecAuditLogDirModeConfigure the directory permission mode for audit log directories
SecAuditLogFileModeConfigure the file permission mode for audit log files
SecAuditLogFormatConfigure the format of the audit log output
SecAuditLogPartsConfigure which parts of a transaction should be recorded
SecAuditLogRelevantStatusConfigure relevant HTTP status codes for audit logging
SecAuditLogStorageDirConfigure the directory for storing audit log files in concurrent mode
SecAuditLogTypeConfigure the type of audit logging mechanism
SecCollectionTimeoutConfigure the expiration time for persistent collections
SecComponentSignatureAdd component signature information to the log
SecCookieFormatConfigure the cookie parsing format version
SecDataDirConfigure the persistent data storage directory
SecDebugLogConfigure the debug log file path
SecDebugLogLevelConfigure the verbosity level of the debug log
SecDefaultActionDefine the default action list for a specific phase
SecGeoLookupDbConfigure the geolocation database file path
SecHttpBlKeyConfigure the HTTP Blacklist API key for @rbl usage
SecMarkerCreate a rule marker for the skipAfter action
SecPcreMatchLimitConfigure the maximum number of PCRE regex matches
SecPcreMatchLimitRecursionConfigure the PCRE regex recursion depth limit
SecRemoteRulesLoad rule configuration from a remote HTTPS server
SecRemoteRulesFailActionConfigure how to handle remote rule loading failures
SecRequestBodyAccessConfigure whether the WAF can access request body content
SecRequestBodyInMemoryLimitConfigure the maximum size of request body buffered in memory
SecRequestBodyJsonDepthLimitConfigure the maximum parsing depth for JSON objects
SecRequestBodyLimitConfigure the maximum acceptable request body size
SecRequestBodyLimitActionConfigure action when request body exceeds limit
SecRequestBodyNoFilesLimitConfigure the maximum request body size without file uploads
SecResponseBodyAccessConfigure whether the WAF can access response body content
SecResponseBodyLimitConfigure the maximum response body buffer size
SecResponseBodyLimitActionConfigure action when response body exceeds limit
SecResponseBodyMimeTypeConfigure which response body MIME types should be inspected
SecResponseBodyMimeTypesClearClear all response body MIME type configurations
SecRuleDefine a security rule
SecRuleEngineConfigure the operating mode of the rule engine
SecRuleRemoveByIdRemove rules by ID
SecRuleRemoveByMsgRemove rules by msg content
SecRuleRemoveByTagRemove rules by tag
SecRuleScriptDefine rule logic using Lua scripts
SecRuleUpdateActionByIdUpdate a rule’s actions by ID
SecRuleUpdateOperatorByIdUpdate the operator of a rule by ID (WGE extension)
SecRuleUpdateOperatorByTagUpdate the operator of rules by tag (WGE extension)
SecRuleUpdateTargetByIdUpdate a rule’s variable list by ID
SecRuleUpdateTargetByMsgUpdate a rule’s variable list by message content
SecRuleUpdateTargetByTagUpdate a rule’s variable list by tag
SecStatusEngineConfigure the status engine for runtime statistics
SecTmpDirConfigure the temporary file storage directory
SecTmpSaveUploadedFilesConfigure whether to save uploaded files to temp directory
SecUnicodeMapFileConfigure the Unicode mapping file path and code page
SecUploadDirConfigure the storage directory for file uploads
SecUploadFileLimitConfigure the maximum number of files per upload request
SecUploadFileModeConfigure the permission mode for uploaded files
SecUploadKeepFilesConfigure whether to keep uploaded files after processing
SecWebAppIdConfigure the web application identifier
SecXmlExternalEntityConfigure whether XML external entity processing is allowed