OWASP CRS levels
Enable the OWASP Core Rule Set by level, permissive to strict; sites choose a level and exclude misfiring rules. Follows CRS releases; paid, either edition.
What it solves
Hand-written WAF rules rarely cover every common attack: SQL injection, cross-site scripting, remote code execution and more. The OWASP Core Rule Set (CRS) is the widely used open rule set; this plugin packages it in levels, permissive, standard, strict and very strict, each adding attack classes and paranoia. A site picks one level, and misfiring rules can be excluded per site.
Turning it on
OWASP CRS levels is an official, paid rule pack bought per installation in the plugin market, in either edition.
- Buy OWASP CRS levels in the plugin store and confirm the install on this control plane under My plugins.
- In the site's WAF protection, choose a managed WAF level; this enables the managed rules in the WAF rule library the site uses, or the system default library when it has none.
- To change only one site, choose "Set for this site" under the site's OWASP CRS level and enter the level and rule IDs to exclude.
Main settings
| Setting | What it does |
|---|---|
| Level | Each level lists its attack classes and rule count and what it adds over the previous one; log only or block |
| Rule group switches | Turning off an attack class disables its rules for sites using this library, at once and without reloading nodes |
| Site level | Follow the library, or set for this site |
| Excluded rule IDs | Six-digit IDs starting with 9, comma-separated; only rules the chosen level allows |
Typical uses
- An ordinary company site: block at the standard level, covering common attacks with fewer false positives than the strict levels.
- A high-risk admin area: use a strict level in log-only mode first, turn off the misfiring rules, then switch to block.
- When automatic defense suggests a higher level, the page shows the level and the reason; switch after confirming.
Limits and notes
- Strict and very strict levels produce noticeably more false positives than standard; observe first.
- Changing level reloads the nodes; exclusions apply at once without a reload.
- After lowering a level, rule packs beyond it are suspended and come back when you return to the level or change packs.
- CRS itself is Apache-2.0 licensed, and the package keeps its LICENSE and NOTICE.