OWASP Coraza WAF

www.coraza.io · 2026-07-02 · by Long Nguyen ·generic
OWASP Coraza is an open source, enterprise-grade, high performance Web Application Firewall designed for APIs and web applications — from legacy to modern.

OWASP Coraza WAF

Loading search index…

No recent searches

No results for "Query here"

Summary here

OWASP Production Project

OWASP Coraza WAF

Open source Web Application Firewall for APIs and web applications. Enterprise-grade protection, 100% compatible with OWASP Core Rule Set.

Get Started Learn More

Built for Modern APIs

High-performance protection for REST, GraphQL, and gRPC endpoints. Coraza handles massive throughput with minimal latency impact.

Enterprise Ready

Hardened for mission-critical infrastructure and high-availability environments.

Legacy Systems

Drop-in replacement for ModSecurity, supporting existing rule sets and workflows.

Universal Deployment

Run as a sidecar, proxy, or library in Go, C++, and WebAssembly.

Why Security Teams Choose Coraza

Engineered for the modern security landscape.

Security First

Rigorous testing and full OWASP CRS compatibility ensure your applications are protected against top threats from day one.

High Performance

Written in Go with an optimized engine, Coraza delivers microsecond-level inspection even at peak traffic loads.

Extensible

A modular plugin architecture allows you to create custom rules, operators, and logging backends tailored to your needs.

Deploy Anywhere

Coraza isn't just a standalone service. Integrate it directly into your infrastructure using our versatile connectors and SDKs.

Envoy Proxy (core)

Istio & Cloud Native

Envoy Proxy (contrib)

Istio & Cloud Native

Caddy Server

Automatic HTTPS

NGINX

High-Performance Proxy

HAProxy

Load Balancing

Envoy Coraza Dynamic Module WAF Filter

http_filters:
  • name: coraza-waf
typed_config: "@type": type.googleapis.com/envoy.extensions.filters.http.dynamic_modules.v3.DynamicModuleFilter dynamic_module_config: load_globally: true name: composer filter_name: coraza-waf filter_config: "@type": type.googleapis.com/google.protobuf.StringValue value: | { "directives": [ "Include @coraza.conf", "SecRuleEngine On", "Include @crs-setup.conf", "Include @owasp_crs/*.conf" ] }

Community Driven

Join the open source security movement.

OWASP GitHub Open Source

Star on GitHub Join Slack

Top

pura: loading…

☰

📷 🔍 Discover ●▶ –

Ready

www.coraza.io · 4 images · 14 links

Comments (0)

No comments yet