# corazawaf/coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

Repository: https://github.com/corazawaf/coraza
Canonical: https://ross.abutalabs.com/products/coraza
Homepage: https://www.coraza.io
Language: Go
License: Apache-2.0
License Family: permissive
Topics: coraza, waf, coraza-waf, owasp-crs, modsecurity, coreruleset, owasp, golang, go, http, web-application-firewall, hacktoberfest
Last push: 2026-08-26T01:17:36+00:00

## Health v2 (maintenance only)
Score: 92/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 78, longevity 100
- inputs: {"age_days": 2289, "days_push": 8, "days_rel": 149, "gap_med": 5, "n_releases_24m": 8}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3761, forks 352 (observed 2026-08-28T04:08:17.916917+00:00)

## What it is
OWASP Coraza is an open-source, enterprise-grade Web Application Firewall (WAF) library written in Go, compatible with ModSecurity SecLang rulesets and 100% compatible with the OWASP Core Rule Set v4. It can be embedded in Go applications or deployed via connectors for Envoy, Istio, Caddy, NGINX, and HAProxy to protect web apps and APIs from attacks like SQL injection and XSS.

## Use cases
- protect my web application from SQL injection and XSS attacks
- drop-in replacement for ModSecurity in Go
- run OWASP Core Rule Set with a Go WAF engine
- add a web application firewall to an Envoy or Caddy proxy
- embed WAF protection in a Go HTTP server as a library
- block malicious HTTP requests before they reach my API

## When to choose
- you need a high-performance, embeddable WAF in Go with ModSecurity SecLang compatibility
- you want to run OWASP CRS v4 rules without the ModSecurity C engine
- you deploy via Envoy, Istio, Caddy, NGINX, or HAProxy and need WAF integration

## When to avoid
- you need a standalone WAF appliance with a management UI out of the box
- you rely on full ModSecurity compatibility including legacy CRS versions or niche features
- your stack is not Go, C++, or WebAssembly and no connector fits your proxy

## Facets
- artifact type: library
- maturity: stable
- function: security, http-server, middleware, plugin-system
- domain: security, web-development, backend, apis
- platform: go, self-hosted, wasm, cross-platform
- tags: waf, web-application-firewall, modsecurity, seclang, owasp-crs, sql-injection-protection, xss-protection, envoy, caddy, reverse-proxy, linux, docker

## Member repositories
- corazawaf/coraza (main) score 92

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:17.916917+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:28:53.468483+00:00, confidence not recorded.
  - readme: https://github.com/corazawaf/coraza (fetched 2026-08-28T04:08:17.916917+00:00, sha 1c45adbe540c)
  - homepage: https://www.coraza.io (fetched 2026-08-29T09:22:53.997633+00:00, sha a22779d41c29)
  - site_page: https://www.coraza.io/docs/tutorials/introduction (fetched 2026-08-29T09:22:54.006926+00:00, sha 9ebe9f596647)
  - site_page: https://www.coraza.io/docs/tutorials/quick-start (fetched 2026-08-29T09:22:54.008976+00:00, sha 123bbdc83f92)
- Data as of 2026-08-30T08:39:29.467469+00:00.