loveshell/ngx_lua_waf

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

4024 stars · 1453 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A lightweight, high-performance web application firewall (WAF) built on lua-nginx-module (OpenResty) for Nginx. It filters requests using regex rules to block SQL injection, XSS, SSRF, webshell uploads, scanners, and CC attacks.

Use cases

• block sql injection and xss attacks on nginx
• prevent webshell uploads
• rate limit cc attacks per ip
• block scanner user agents
• prevent backup and svn file leaks
• add a waf to openresty

When to choose

• you run nginx/openresty and want a simple, lightweight WAF with regex rules
• you need basic protection against common web attacks without a heavy appliance
• you want per-IP CC rate limiting built into nginx

When to avoid

• you need dynamically managed rules via shared memory or redis
• you need advanced WAF features like a commercial ruleset or machine-learning detection
• you don't control nginx configuration or can't install lua modules

Facets

library · maturity maintenance

security rate-limiting middleware logging security web-development backend self-hosted waf web-application-firewall lua-nginx-module openresty sql-injection xss cc-attack-protection webshell-prevention nginx linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="loveshell/ngx_lua_waf")