Operators

Operators consume data from variables. In practice, an operator only evaluates one input item at a time. For example, ARGS may contain multiple parameter values, but an operator evaluates each value independently. A rule is considered matched if any evaluated value matches.

From the input data perspective, operators can be divided into two categories: string input and integer input. Most variable data are strings (except count variables such as &... and some TX usages). If the provided input does not satisfy the operator’s required type, the operator returns no match.

Operators also support negation. Example:

SecRule ARGS "!@beginswith admin" "id:1001,phase:2,deny,t:none"

A rule can contain multiple operators joined by |, which means OR relation. Only one sub-operator needs to match:

SecRule ARGS "!@beginswith admin|@endswith user|@streq passwd" "id:1001,phase:2,deny,t:none"

Most operators support macro expansion, so operator parameters can be dynamically resolved from variables:

SecRule REQUEST_HEADERS:Referer "@rx %{REQUEST_HEADERS:Host}" "id:1001,phase:2,deny,t:none"

Note: When a variable has no data, actions are not executed in any case. This remains true even with control prefixes such as !setvar or *setvar. @noMatch and @unconditionalMatch are also ineffective in this scenario and still return no match.