# ADD-SP/ngx_waf

Handy, High performance, ModSecurity compatible Nginx firewall module & 方便、高性能、兼容 ModSecurity 的 Nginx 防火墙模块

Repository: https://github.com/ADD-SP/ngx_waf
Canonical: https://ross.abutalabs.com/products/ngx_waf
Homepage: https://add-sp.github.io/ngx_waf-docs/
Language: C
License: BSD-3-Clause
License Family: permissive
Topics: nginx, nginx-modules, web-application-firewall, waf, modsecurity, modsecurity-nginx, openresty, captcha, hcaptcha, recaptcha
Last push: 2025-01-25T08:32:04+00:00

## Health v2 (maintenance only)
Score: 24/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 3, release rhythm 8, longevity 100
- inputs: {"age_days": 2216, "days_push": 585, "days_rel": 585, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1631, forks 193 (observed 2026-08-28T04:05:14.083726+00:00)

## What it is
ngx_waf is a high-performance Nginx firewall module written in C that provides web application firewall capabilities. It is compatible with ModSecurity rules (including the OWASP Core Rule Set) and offers IP/URL blacklists, anti-SQL-injection and anti-XSS via libinjection, CAPTCHA challenges, and friendly crawler verification.

## Use cases
- protect my nginx server from sql injection and xss attacks
- block malicious ips and user agents at the web server level
- add a waf to nginx compatible with modsecurity rules
- use owasp modsecurity core rule set with nginx
- add captcha challenges like hcaptcha or recaptcha to nginx
- allow googlebot and other search engine crawlers while blocking bots
- rate limit and auto-block ips doing challenge collapsar attacks

## When to choose
- you run nginx or openresty and want an in-process, high-performance WAF without a separate reverse proxy
- you want ModSecurity/OWASP CRS rule compatibility with simpler configuration
- you need built-in CAPTCHA support and friendly crawler verification

## When to avoid
- you use a web server other than nginx (e.g., Apache, Caddy, HAProxy)
- you need a full-featured standalone WAF with a management UI or centralized rule management
- you cannot compile custom nginx modules

## Facets
- artifact type: plugin
- maturity: active
- function: security, middleware, rate-limiting
- domain: security, web-development, backend
- platform: self-hosted
- tags: waf, nginx-module, modsecurity, captcha, sql-injection, xss, openresty, linux, nginx

## Member repositories
- ADD-SP/ngx_waf (main) score 24

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:14.083726+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:47:48.687611+00:00, confidence not recorded.
  - readme: https://github.com/ADD-SP/ngx_waf (fetched 2026-08-28T04:05:14.083726+00:00, sha a749a8363a82)
  - homepage: https://add-sp.github.io/ngx_waf-docs/ (fetched 2026-08-29T11:20:22.598686+00:00, sha c32f6b966f60)
- Data as of 2026-08-30T08:39:29.467469+00:00.