If you run a WAF backed by ModSecurity or Coraza (the Go rewrite most modern setups use now — nginx, HAProxy via SPOE, Traefik plugins, etc.), sooner or later you write a custom SecRule by hand. The syntax is powerful and genuinely well-designed once it clicks, but the learning curve is real — most people's first custom rule either silently does nothing or blocks traffic they didn't mean to.
Here's the anatomy of a rule, and the specific mistakes that actually trip people up.
The shape of a SecRule
Every rule is three parts: what to look at, how to match it, what to do.
SecRule VARIABLE "OPERATOR value" "ACTIONS"
