Skip to content
SPECIFICTION
Get listed

OWASP Coraza WAF

coraza.io

Free plan macOSLinuxAPISelf-hosted
Visit coraza.io
Spec score 7.6 #9 of 29 in Web Security Software

What it is

OWASP Coraza WAF is a free, open-source Web Application Firewall for APIs and web applications. It supports ModSecurity SecLang rulesets and is fully compatible with the OWASP Core Rule Set. That ruleset covers threats including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock and scanner or bot activity. Coraza can run as a sidecar, proxy or library in Go, C++ and WebAssembly. Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik and libcoraza. Documentation describes extension points for audit loggers, persistence engines, operators, actions and plugins, with examples for GeoIP and a package containing the Core Rule Set and recommended configuration. The Quick Start requires Go 1.24 or later. Platforms listed are API, Linux, macOS and self-hosted. Coraza offers managed rule sets, API protection and bot management. The v3 internals documentation says persistent collections such as IP, SESSION and RESOURCE are not currently supported. Coraza Playground provides a sandbox web interface for testing rules. The Open source plan is listed at free.

Spec sheet

Purpose
Coraza is an open-source Web Application Firewall for APIs and web applications.Read 4 Oct 2026 · coraza.io
Platforms
The introduction lists Linux distributions and Mac as prerequisites and states that Windows is not yet supported.Read 4 Oct 2026 · coraza.io
Deployment
The product page says Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly.Read 4 Oct 2026 · coraza.io
Integrations
Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza.Read 4 Oct 2026 · coraza.io
Founded
2021Read 28 Sep 2026 · coraza.io
Extensibility
Coraza’s documentation describes extensions through audit loggers, persistence engines, operators, actions, and plugins.Read 4 Oct 2026 · coraza.io
Limit
The internals documentation says persistent collections such as IP, SESSION, and RESOURCE are currently not supported in Coraza v3.Read 4 Oct 2026 · coraza.io
Plugin examples
Official plugins include GeoIP support and a package that embeds the OWASP Core Rule Set and recommended Coraza configuration.Read 4 Oct 2026 · coraza.io
Rule compatibility
Coraza supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.Read 4 Oct 2026 · coraza.io
Runtime requirement
The Quick Start page lists Go 1.24+ as a requirement.Read 4 Oct 2026 · coraza.io
Security testing
The docs provide Coraza Playground as a sandbox web interface for testing rules.Read 4 Oct 2026 · coraza.io
Support and community
The documentation points users to GitHub Discussions and the OWASP Slack community (#coraza).Read 4 Oct 2026 · coraza.io
Threat coverage
The documentation says OWASP CRS protects against attacks including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity.Read 4 Oct 2026 · coraza.io

Plans and prices

Open source Free Apache-2.0 connectors · self-hosted deployment Read 4 Oct 2026 · coraza.io

Every OWASP Coraza WAF plan and price →

Strong points and limits

Strong points

  • Free open-source plan
  • OWASP Core Rule Set compatible
  • Multiple official connectors
  • API and bot protection
  • Sandbox rule testing

Limits

  • Requires Go 1.24 or later
  • Persistent collections unsupported in v3
  • Self-hosted deployment listed
  • No free trial

Who it suits

It suits teams deploying an open-source WAF for APIs or web applications on Linux, macOS or self-hosted infrastructure. Developers using Go, C++ or WebAssembly can deploy it as a sidecar, proxy or library.

Verdict

Coraza provides an open-source WAF with broad connector, runtime and rule compatibility. Teams should account for the Go requirement and the current absence of persistent collections in version 3.

Where Specifiction places it

Alternatives to OWASP Coraza WAFAll alternatives →