Setup mod security on apache2

apt-get install libapache2-modsecurity

mv /etc/modsecurity/modsecurity.conf{-recommended,}

Find this line
SecRuleEngine DetectionOnly


and change it to:
SecRuleEngine On

use below link:

https://www.digitalocean.com/community/tutorials/how-to-set-up-mod_security-with-apache-on-debian-ubuntu