How to enable and setup ModSecurity on a Mac?

Use brew to install the ModSecurity Apache module.

brew install homebrew/apache/mod_security

Ask Apache to load the module by editing the configuration file (at /etc/apache2/httpd.conf). Under the long list of LoadModule statements, add:

LoadModule security2_module /usr/local/Cellar/mod_security/2.7.7/libexec/mod_security2.so

While you are at it, load the mod_unique_id module as well. This is required by ModSecurity. Do so by uncommenting the line:

LoadModule unique_id_module libexec/apache2/mod_unique_id.so

Copy the ModSecurity recommended configuration to a place where it can get picked up by Apache automatically.

cp  /usr/local/Cellar/mod_security/2.7.7/modsecurity.conf-recommended \
    /etc/apache/other/modsecurity.conf

Once you have done this, test that Modsecurity is indeed active by trying this out:

And after that clone and link the OWASP Core Rule Set by following the instructions here:

amarnus/modsecurity_mac.md