# ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis.

Repository: https://github.com/owasp-modsecurity/ModSecurity
Canonical: https://ross.abutalabs.com/products/modsecurity
Homepage: https://www.modsecurity.org
Language: C++
License: Apache-2.0
License Family: permissive
Topics: modsecurity, nginx, apache, apache2, waf
Last push: 2026-07-28T14:23:43+00:00
Link (homepage): https://www.modsecurity.org
Link (site_page): https://modsecurity.org/faq
Link (site_page): https://modsecurity.org/20260629/about-cve-2026-52747-and-2026-52761
Link (site_page): https://modsecurity.org/20260428/about-cve-2026-30923-and-2026-42268

## Health v2 (maintenance only)
Score: 90/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 94, release rhythm 79, longevity 100
- inputs: {"age_days": 5691, "days_push": 36, "days_rel": 62, "gap_med": 31.5, "n_releases_24m": 11}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 9752, forks 1745 (observed 2026-08-28T04:10:37.069225+00:00)

## What it is
ModSecurity (libmodsecurity v3) is an open source, cross-platform web application firewall (WAF) engine written in C++ that inspects HTTP(S) traffic using the ModSecurity SecRules rules language. It integrates with Apache, Nginx, and IIS via connectors and pairs with the OWASP Core Rule Set for attack protection, traffic logging, and real-time analysis.

## Use cases
- block malicious HTTP requests to my web application
- add a web application firewall to nginx
- log and monitor all HTTP traffic on my web server
- protect against SQL injection and XSS with OWASP Core Rule Set
- inspect request bodies and headers with custom WAF rules
- harden a web application against common attacks

## When to choose
- you need a mature, widely deployed open source WAF engine for Apache, Nginx, or IIS
- you want rule-based HTTP traffic inspection with the OWASP Core Rule Set
- you need full HTTP audit logging and real-time security monitoring

## When to avoid
- you need a cloud-managed or SaaS WAF without server-side deployment
- you want a modern Rust/Go WAF with a simpler configuration model (e.g., Coraza may fit better)
- you only need rate limiting or basic header filtering rather than full rule-based inspection

## Facets
- artifact type: library
- maturity: stable
- function: security, http-server, logging, monitoring, middleware
- domain: security, web-development, backend, apis
- platform: cross-platform, cpp
- tags: waf, web-application-firewall, owasp, nginx, apache, iis, secrules, http-traffic-inspection, libmodsecurity, linux, web-server

## Member repositories
- owasp-modsecurity/ModSecurity (main) score 90
- owasp-modsecurity/ModSecurity-nginx (plugin) score 59

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:37.069225+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:21:11.822025+00:00, confidence not recorded.
  - readme: https://github.com/owasp-modsecurity/ModSecurity (fetched 2026-08-28T04:10:37.069225+00:00, sha 4332f09e4ef7)
  - homepage: https://www.modsecurity.org (fetched 2026-08-29T08:20:47.487074+00:00, sha 99f43d59ad8b)
  - site_page: https://modsecurity.org/20260629/about-cve-2026-52747-and-2026-52761 (fetched 2026-08-29T08:20:47.498223+00:00, sha 1ec9f8712e43)
  - site_page: https://modsecurity.org/20260428/about-cve-2026-30923-and-2026-42268 (fetched 2026-08-29T08:20:47.499893+00:00, sha 133cf0bb8ea9)
  - site_page: https://modsecurity.org/faq (fetched 2026-08-29T08:20:47.496399+00:00, sha c7faf6fc6f67)
- Data as of 2026-08-30T08:39:29.467469+00:00.