title: ModSecurity Ratelimiting Login Failures
body: <p>I am trying to build a rule to limit the number of xmlrpc.php authentication failures to 5 per minute. The ModSecurity rules I have so far are:</p>
  
  <pre><code>SecAction phase:1,nolog,pass,initcol:IP=%{REMOTE_ADDR},id:690010
  &lt;LocationMatch "/xmlrpc.php"&gt;
  SecRule IP:COUNTXYZ "@gt 5" "phase:1,deny,status:403,log,msg:'WAF Rules : IP address blocked - more than 5 xmlrpc errors in 60 seconds',id:690011"
  SecRule RESPONSE_BODY "faultCode" "phase:4,pass,nolog,setvar:ip.countxyz=+1,deprecatevar:ip.countxyz=1/60,id:690012"
  &lt;/LocationMatch&gt;
  </code></pre>
  
  <p>Despite repeated calls to site on this server using:</p>
  
  <pre><code>curl -d '&lt;?xml version="1.0"?&gt; &lt;methodCall&gt; &lt;methodName&gt;wp.getUsersBlogs&lt;/methodName&gt; &lt;params&gt; &lt;param&gt; &lt;value&gt;username&lt;/value&gt; &lt;/param&gt; &lt;param&gt; &lt;value&gt;password&lt;/value&gt; &lt;/param&gt; &lt;/params&gt; &lt;/methodCall&gt;' http://victimsite/xmlrpc.php
  </code></pre>
  
  <p>which in each case sends back a body containing the text 'faultCode' - but it never blocks the requests, even though each request comes from a fixed IP address. Is there a problem in my rules syntax, or is there a way i can debug this?</p>