coreruleset/coreruleset resource

Health v2 · maintenance only

Adoption not part of the score

3242 stars · 467 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

OWASP Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity, Coraza, or other compatible web application firewalls. It protects web applications from common attacks like SQL injection, XSS, and the OWASP Top Ten with minimal false positives.

Use cases

• protect a web application from SQL injection and XSS attacks
• add a WAF ruleset to ModSecurity or Coraza
• block OWASP Top Ten attacks on Apache or Nginx
• detect web shells and code injection attempts
• reduce false positives when filtering malicious HTTP traffic
• monitor and log attack attempts against my web server

When to choose

• you run your own web server (Apache, Nginx, IIS) with ModSecurity or a compatible WAF engine and need a battle-tested generic attack detection policy
• you want community-maintained rules covering SQLi, XSS, LFI/RFI, SSTI, and other common attack categories
• you need anomaly scoring, paranoia levels, and a plugin architecture for tuning

When to avoid

• you need a WAF engine itself - CRS is only the rule set and requires ModSecurity, Coraza, or a compatible engine
• you need application-specific business logic protection rather than generic attack signatures
• you cannot tolerate any false positives without investing time in tuning

Facets

dataset · maturity stable

security vulnerability-scanning middleware http-server security web-development backend self-hosted waf modsecurity ruleset owasp web-application-firewall sql-injection xss coraza web-server linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="coreruleset/coreruleset")