SpiderLabs/owasp-modsecurity-crs

Health v2 · maintenance only

Flags: archived

Adoption not part of the score

2491 stars · 726 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls, protecting against the OWASP Top Ten and other attacks with minimal false positives. This original SpiderLabs repository is archived; the project has moved to github.com/coreruleset/coreruleset.

Use cases

• protect a web application from common attacks with a WAF
• block OWASP Top Ten vulnerabilities using ModSecurity
• get a free starting ruleset for a web application firewall
• reduce false positives in WAF attack detection
• harden an nginx or Apache server with ModSecurity rules

When to choose

• you need battle-tested generic WAF rules for ModSecurity or a compatible engine
• you want OWASP-endorsed protection against common web attacks
• you need a community-maintained ruleset with tuning options

When to avoid

• you want active development - use the successor at coreruleset/coreruleset instead
• you need a WAF engine itself rather than a ruleset
• you run a firewall incompatible with ModSecurity rule syntax

Facets

plugin · maturity abandoned

security middleware security web-development backend self-hosted waf modsecurity owasp web-application-firewall ruleset archived moved-to-coreruleset web-server linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="SpiderLabs/owasp-modsecurity-crs")