# coreruleset/coreruleset

OWASP CRS (Official Repository)

Repository: https://github.com/coreruleset/coreruleset
Canonical: https://ross.abutalabs.com/products/coreruleset
Homepage: https://coreruleset.org
Language: Python
License: Apache-2.0
License Family: permissive
Topics: security, ruleset, owasp, crs, waf
Last push: 2026-08-26T21:54:17+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 98, longevity 100
- inputs: {"age_days": 2303, "days_push": 7, "days_rel": 16, "gap_med": 29, "n_releases_24m": 30}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 3242, forks 467 (observed 2026-08-28T04:07:50.564461+00:00)

## What it is
OWASP Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity, Coraza, or other compatible web application firewalls. It protects web applications from common attacks like SQL injection, XSS, and the OWASP Top Ten with minimal false positives.

## Use cases
- protect a web application from SQL injection and XSS attacks
- add a WAF ruleset to ModSecurity or Coraza
- block OWASP Top Ten attacks on Apache or Nginx
- detect web shells and code injection attempts
- reduce false positives when filtering malicious HTTP traffic
- monitor and log attack attempts against my web server

## When to choose
- you run your own web server (Apache, Nginx, IIS) with ModSecurity or a compatible WAF engine and need a battle-tested generic attack detection policy
- you want community-maintained rules covering SQLi, XSS, LFI/RFI, SSTI, and other common attack categories
- you need anomaly scoring, paranoia levels, and a plugin architecture for tuning

## When to avoid
- you need a WAF engine itself - CRS is only the rule set and requires ModSecurity, Coraza, or a compatible engine
- you need application-specific business logic protection rather than generic attack signatures
- you cannot tolerate any false positives without investing time in tuning

## Facets
- artifact type: dataset
- maturity: stable
- function: security, vulnerability-scanning, middleware, http-server
- domain: security, web-development, backend
- platform: self-hosted
- tags: waf, modsecurity, ruleset, owasp, web-application-firewall, sql-injection, xss, coraza, web-server, linux, docker

## Member repositories
- coreruleset/coreruleset (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:50.564461+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:24:30.363548+00:00, confidence not recorded.
  - readme: https://github.com/coreruleset/coreruleset (fetched 2026-08-28T04:07:50.564461+00:00, sha c6908fadb5ac)
  - homepage: https://coreruleset.org (fetched 2026-08-29T09:37:23.645212+00:00, sha b7493f9b0242)
  - site_page: https://coreruleset.org/docs/1-getting-started/1-1-crs-installation (fetched 2026-08-29T09:37:23.648943+00:00, sha 84b66c721e3b)
  - site_page: https://coreruleset.org/docs/6-development/6-1-contribution-guidelines (fetched 2026-08-29T09:37:23.650905+00:00, sha 7ec43f45437c)
  - site_page: https://coreruleset.org/docs/3-about-rules/creating (fetched 2026-08-29T09:37:23.653321+00:00, sha 88067791b016)
  - site_page: https://coreruleset.org/docs/2-how-crs-works (fetched 2026-08-29T09:37:23.656662+00:00, sha 2c123a860afb)
  - site_page: https://coreruleset.org/docs/8-additional-resources (fetched 2026-08-29T09:37:23.658103+00:00, sha f2b8d6152ba2)
  - site_page: https://coreruleset.org/docs/6-development/6-6-useful_tools (fetched 2026-08-29T09:37:23.659608+00:00, sha e8ced3022a1c)
  - site_page: https://coreruleset.org/faq (fetched 2026-08-29T09:37:23.655084+00:00, sha ba2ddd8220a6)
- Data as of 2026-08-30T08:39:29.467469+00:00.