OWASP Coraza WAF

6.7easy start · #14 of 32
in Web Application Firewall Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you worknot on record

Runs on api, Linux, Mac, self-hosted.

OWASP Coraza WAF is ranked #14 of 32 in web application firewall software on The Geeks Club. It runs on API, Linux, macOS, Self-hosted. There is a free plan.

OWASP Coraza WAF plans and pricing

All plans

Open source Free Apache-2.0 connectors · self-hosted deployment coraza.io · 4 Oct 2026

Compared on web application firewall software

Free plan: Yes
Managed rule sets: Yes
API protection: Yes
Bot management: Yes

Best OWASP Coraza WAF alternatives

See all 20

Cloudbric 0 of 4 in the starter kit Lesson 18.0 BitNinja 0 of 4 in the starter kit Lesson 27.8 BunkerWeb 0 of 4 in the starter kit Lesson 37.6 Gcore WAAP 0 of 4 in the starter kit Lesson 47.6 Security Ninja 0 of 4 in the starter kit Lesson 57.6 Haltdos 0 of 4 in the starter kit Lesson 67.5

The record

Purpose: Coraza is an open-source Web Application Firewall for APIs and web applications.
Rule compatibility: Coraza supports ModSecurity SecLang rulesets and is 100% compatible with the OWASP Core Rule Set.
Threat coverage: The documentation says OWASP CRS protects against attacks including SQL injection, cross-site scripting, code injection, HTTPoxy, Shellshock, and scanner or bot activity.
Deployment: The product page says Coraza can run as a sidecar, proxy, or library in Go, C++, and WebAssembly.
Integrations: Official connectors are listed for NGINX, Envoy, Caddy, Apache APISIX, proxy-wasm, HAProxy, Traefik, and libcoraza.
Extensibility: Coraza’s documentation describes extensions through audit loggers, persistence engines, operators, actions, and plugins.
Plugin examples: Official plugins include GeoIP support and a package that embeds the OWASP Core Rule Set and recommended Coraza configuration.
Platforms: The introduction lists Linux distributions and Mac as prerequisites and states that Windows is not yet supported.
Runtime requirement: The Quick Start page lists Go 1.24+ as a requirement.
Support and community: The documentation points users to GitHub Discussions and the OWASP Slack community (#coraza).
Limit: The internals documentation says persistent collections such as IP, SESSION, and RESOURCE are currently not supported in Coraza v3.
Security testing: The docs provide Coraza Playground as a sandbox web interface for testing rules.
Founded: 2021
Price from: Free

Where it ranks on The Geeks Club

Best Web Application Firewall Software in 2026#14 of 32

Is OWASP Coraza WAF yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OWASP Coraza WAF

Sources

coraza.io· checked 4 Oct 2026
coraza.io/docs/tutorials/introduction/· checked 4 Oct 2026
coraza.io/connectors/· checked 4 Oct 2026
coraza.io/plugins/· checked 4 Oct 2026
coraza.io/docs/tutorials/quick-start/· checked 4 Oct 2026
coraza.io/docs/reference/internals/· checked 4 Oct 2026