Abstract: Disclosed is an apparatus for enhancing the security of a web server from intrusive attacks in the form of HTTP (hypertext transfer) requests. This is accomplished by comparing an incoming request with a predefined list of attack signatures which may comprise at least files, file categories and IP addresses of known hackers. Action is then taken to reject any requests wherein a positive comparison is determined. Further, the web server is notified of relevant data provided in connection with any rejected request for potential future action in accordance with the severity of potential damage and frequency of rejected requests from a given requestor.