Ross ROSS = Recommend OSS · open-source software intelligence for agents

ModSecurity

ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. observed · 2026-08-28

github.com/owasp-modsecurity/ModSecurity · homepage · C++ · Apache-2.0 (permissive) observed · 2026-08-28

Health v2 · maintenance only

90/100

  • Activity 94
  • Release rhythm 79
  • Longevity 100
How is this computed?

round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.

  • gap_med: 31.5
  • age_days: 5691
  • days_rel: 62
  • days_push: 36
  • n_releases_24m: 11

Full methodology

Adoption not part of the score

9752 stars · 1745 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

ModSecurity (libmodsecurity v3) is an open source, cross-platform web application firewall (WAF) engine written in C++ that inspects HTTP(S) traffic using the ModSecurity SecRules rules language. It integrates with Apache, Nginx, and IIS via connectors and pairs with the OWASP Core Rule Set for attack protection, traffic logging, and real-time analysis.

Use cases

  • block malicious HTTP requests to my web application
  • add a web application firewall to nginx
  • log and monitor all HTTP traffic on my web server
  • protect against SQL injection and XSS with OWASP Core Rule Set
  • inspect request bodies and headers with custom WAF rules
  • harden a web application against common attacks

When to choose

  • you need a mature, widely deployed open source WAF engine for Apache, Nginx, or IIS
  • you want rule-based HTTP traffic inspection with the OWASP Core Rule Set
  • you need full HTTP audit logging and real-time security monitoring

When to avoid

  • you need a cloud-managed or SaaS WAF without server-side deployment
  • you want a modern Rust/Go WAF with a simpler configuration model (e.g., Coraza may fit better)
  • you only need rate limiting or basic header filtering rather than full rule-based inspection

Facets

library · maturity stable

security http-server logging monitoring middleware security web-development backend apis cross-platform cpp waf web-application-firewall owasp nginx apache iis secrules http-traffic-inspection libmodsecurity linux web-server

5 sources

Member repositories

For agents

markdown · JSON · MCP: product_card(name="owasp-modsecurity/ModSecurity")

Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem