ModSecurity
Web application firewall: inspects every request to the websites on this server and stops attacks such as SQL injection, XSS and file inclusion, using the OWASP Core Rule Set.
ModSecurity is not installed
Installs the nginx ModSecurity module and the OWASP Core Rule Set, then starts in Detection-only mode: attacks are logged but nothing is blocked until you switch to Blocking.