OWASP Coraza WAF vs Wordfence Security

OWASP Coraza WAF is a free, open-source Web Application Firewall for APIs and web applications. It supports ModSecurity SecLang rulesets and is fully compatible with the OWASP Core Rule Set. That ruleset covers threats including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock and scanner or bot activity. Coraza can run as a sidecar, proxy or library in Go, C++ and WebAssembly. Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik and libcoraza. Documentation describes extension points for audit loggers, persistence engines, operators, actions and plugins, with examples for GeoIP and a package containing the Core Rule Set and recommended configuration. The Quick Start requires Go 1.24 or later. Platforms listed are API, Linux, macOS and self-hosted. Coraza offers managed rule sets, API protection and bot management. The v3 internals documentation says persistent collections such as IP, SESSION and RESOURCE are not currently supported. Coraza Playground provides a sandbox web interface for testing rules. The Open source plan is listed at free.

Wordfence Security is a WordPress plugin for protecting self-hosted sites, with an endpoint Web Application Firewall, malware scanner, login controls, and live traffic views. The firewall identifies and blocks malicious traffic at the WordPress endpoint. Scanning covers core files, themes, and plugins for malware, backdoors, redirects, code injections, and known vulnerabilities. Login security includes passkeys, two-factor authentication, CAPTCHA, and brute-force protection. Wordfence Central is free for users and can manage sites, launch scans, apply configuration templates, and send alerts through email, SMS, Slack, and Discord. The free plan costs nothing, scans every three days, and receives firewall and malware-signature updates with a 30-day delay. Premium costs $149 a year; Care costs $590 a year; Response costs $1,250 a year. Paid plans provide real-time updates, while each plugin installation requires a unique license key.