ADD-SP/ngx_waf

Health v2 · maintenance only

Adoption not part of the score

1631 stars · 193 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

ngx_waf is a high-performance Nginx firewall module written in C that provides web application firewall capabilities. It is compatible with ModSecurity rules (including the OWASP Core Rule Set) and offers IP/URL blacklists, anti-SQL-injection and anti-XSS via libinjection, CAPTCHA challenges, and friendly crawler verification.

Use cases

• protect my nginx server from sql injection and xss attacks
• block malicious ips and user agents at the web server level
• add a waf to nginx compatible with modsecurity rules
• use owasp modsecurity core rule set with nginx
• add captcha challenges like hcaptcha or recaptcha to nginx
• allow googlebot and other search engine crawlers while blocking bots
• rate limit and auto-block ips doing challenge collapsar attacks

When to choose

• you run nginx or openresty and want an in-process, high-performance WAF without a separate reverse proxy
• you want ModSecurity/OWASP CRS rule compatibility with simpler configuration
• you need built-in CAPTCHA support and friendly crawler verification

When to avoid

• you use a web server other than nginx (e.g., Apache, Caddy, HAProxy)
• you need a full-featured standalone WAF with a management UI or centralized rule management
• you cannot compile custom nginx modules

Facets

plugin · maturity active

security middleware rate-limiting security web-development backend self-hosted waf nginx-module modsecurity captcha sql-injection xss openresty linux nginx

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ADD-SP/ngx_waf")