The group contains insecure direct object reference deny rules and file inclusion deny rules for HTTP paths.

The security level Basic and Standard prevents directory traversal and injection of certain critical files (e.g. .htaccess).

The security level Strict further prevents injection of file paths with critical suffixes (e.g. .exe).