OWASP Coraza WAF

No phone app

7.5No. 4 of 23
in Web Application Firewall Software

Recognised40% of the score74
Phone app26% of the score0
Documented20% of the score88
Free plan14% of the score100

Free plan: Yes
Runs on: api, Linux, Mac, self-hosted

Summary

OWASP Coraza WAF is ranked #4 of 23 in web application firewall software on Samsung Mobile US Press. It runs on API, Linux, macOS, Self-hosted. There is a free plan.

OWASP Coraza WAF plans and pricing

All plans

Open source Free Apache-2.0 connectors · self-hosted deployment coraza.io · 4 Oct 2026

Compared on web application firewall software

Free plan: Yescoraza.io
Managed rule sets: Yescoraza.io
API protection: Yescoraza.io
Bot management: Yescoraza.io

Facts

Purpose: Coraza is an open-source Web Application Firewall for APIs and web applications.coraza.io · 4 Oct 2026
Rule compatibility: Coraza supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.coraza.io · 4 Oct 2026
Threat coverage: The documentation says OWASP CRS protects against attacks including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity.coraza.io · 4 Oct 2026
Deployment: The product page says Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly.coraza.io · 4 Oct 2026
Integrations: Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza.coraza.io · 4 Oct 2026
Extensibility: Coraza’s documentation describes extensions through audit loggers, persistence engines, operators, actions, and plugins.coraza.io · 4 Oct 2026
Plugin examples: Official plugins include GeoIP support and a package that embeds the OWASP Core Rule Set and recommended Coraza configuration.coraza.io · 4 Oct 2026
Platforms: The introduction lists Linux distributions and Mac as prerequisites and states that Windows is not yet supported.coraza.io · 4 Oct 2026
Runtime requirement: The Quick Start page lists Go 1.24+ as a requirement.coraza.io · 4 Oct 2026
Support and community: The documentation points users to GitHub Discussions and the OWASP Slack community (#coraza).coraza.io · 4 Oct 2026
Limit: The internals documentation says persistent collections such as IP, SESSION, and RESOURCE are currently not supported in Coraza v3.coraza.io · 4 Oct 2026
Security testing: The docs provide Coraza Playground as a sandbox web interface for testing rules.coraza.io · 4 Oct 2026