diff --git a/README.md b/README.md index 71c60bd..d8a5394 100644 --- a/README.md +++ b/README.md @@ -378,8 +378,8 @@ If set to yes, the ModSecurity WAF will be enabled. You can include custom rules by adding .conf files into the /modsec-confs/ directory inside the container (i.e : through a volume). `USE_MODSECURITY_CRS` -Values: *yes* | *no* -Default value : *yes* +Values : *yes* | *no* +Default value : *yes* If set to yes, the [OWASP ModSecurity Core Rule Set](https://coreruleset.org/) will be used. It provides generic rules to detect common web attacks. You can customize the CRS (i.e. : add WordPress exclusions) by adding custom .conf files into the /modsec-crs-confs/ directory inside the container (i.e : through a volume). Files inside this directory are included before the CRS rules. If you need to tweak (i.e. : SecRuleUpdateTargetById) put .conf files inside the /modsec-confs/ which is included after the CRS rules.