OWASP Coraza WAF
OWASP Coraza WAF is a free, open-source Web Application Firewall for APIs and web applications.
What OWASP Coraza WAF is
OWASP Coraza WAF is a free, open-source Web Application Firewall for APIs and web applications. It supports ModSecurity SecLang rulesets and is compatible with the OWASP Core Rule Set, whose protections include SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity. Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly. Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza. Documentation describes extension points such as audit loggers, persistence engines, operators, actions, and plugins; examples include GeoIP support and a plugin package with the Core Rule Set and recommended configuration. The Quick Start requires Go 1.24 or later. Coraza supports API, Linux, macOS, and self-hosted deployments. Its v3 documentation notes that persistent collections including IP, SESSION, and RESOURCE are not currently supported. Coraza Playground provides a sandbox web interface for testing rules. The open-source plan is listed as free.
Good
- Free, open-source WAF
- Compatible with the OWASP Core Rule Set
- Runs as a sidecar, proxy, or library
- Official connectors cover several proxy and server tools
- Includes a sandbox for testing rules
Watch out
- Quick Start requires Go 1.24 or later
- Persistent collections are not supported in Coraza v3
Who it suits
Coraza suits teams seeking a free, self-hosted WAF for APIs or web applications, particularly those using compatible connectors or SecLang rulesets. Users should check the Go requirement and the stated v3 persistent-collection limitation.
Verdict
Coraza offers flexible deployment and compatibility with established rule formats, with a free open-source plan. Its runtime requirement and v3 collection limitation are important implementation considerations.
Plans and prices
From OWASP Coraza WAF's own pricing page, checked 4 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Open source | Free | Apache-2.0 connectors · self-hosted deployment |
The facts
Each one read from OWASP Coraza WAF's own pages, with the date it was checked.
What it does
- Deployment
- The product page says Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly.checked 4 Oct 2026
- Extensibility
- Coraza’s documentation describes extensions through audit loggers, persistence engines, operators, actions, and plugins.checked 4 Oct 2026
- Integrations
- Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza.checked 4 Oct 2026
- Limit
- The internals documentation says persistent collections such as IP, SESSION, and RESOURCE are currently not supported in Coraza v3.checked 4 Oct 2026
- Plugin examples
- Official plugins include GeoIP support and a package that embeds the OWASP Core Rule Set and recommended Coraza configuration.checked 4 Oct 2026
- Purpose
- Coraza is an open-source Web Application Firewall for APIs and web applications.checked 4 Oct 2026
- Rule compatibility
- Coraza supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.checked 4 Oct 2026
- Runtime requirement
- The Quick Start page lists Go 1.24+ as a requirement.checked 4 Oct 2026
- Security testing
- The docs provide Coraza Playground as a sandbox web interface for testing rules.checked 4 Oct 2026
- Support and community
- The documentation points users to GitHub Discussions and the OWASP Slack community (#coraza).checked 4 Oct 2026
- Threat coverage
- The documentation says OWASP CRS protects against attacks including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity.checked 4 Oct 2026
The company
- Founded
- 2021checked 28 Sep 2026
Where it runs
- Platforms
- The introduction lists Linux distributions and Mac as prerequisites and states that Windows is not yet supported.checked 4 Oct 2026
Alternatives to OWASP Coraza WAF
- 1
Cloudflare Gateway
Free planAndroidiOSWebAPI8.3$7 usage-based - 2
DNSFilter
AndroidiOSWebAPI7.8From $1 a month - 3
MalCare
Free planWebSelf-hosted6.9From $99 a year - 4
DataDome API Protection
AndroidiOSWebAPI6.8From $3,830 a month - 5
Gcore WAAP
Free planWebAPI6.8From €25 a month - 6
Wordfence Security
Free planWebSelf-hosted6.8From $149 a year