ModSecurity
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. observed · 2026-08-28
Health v2 · maintenance only
90/100
- Activity 94
- Release rhythm 79
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 31.5
- age_days: 5691
- days_rel: 62
- days_push: 36
- n_releases_24m: 11
Adoption not part of the score
9752 stars · 1745 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
ModSecurity (libmodsecurity v3) is an open source, cross-platform web application firewall (WAF) engine written in C++ that inspects HTTP(S) traffic using the ModSecurity SecRules rules language. It integrates with Apache, Nginx, and IIS via connectors and pairs with the OWASP Core Rule Set for attack protection, traffic logging, and real-time analysis.
Use cases
- block malicious HTTP requests to my web application
- add a web application firewall to nginx
- log and monitor all HTTP traffic on my web server
- protect against SQL injection and XSS with OWASP Core Rule Set
- inspect request bodies and headers with custom WAF rules
- harden a web application against common attacks
When to choose
- you need a mature, widely deployed open source WAF engine for Apache, Nginx, or IIS
- you want rule-based HTTP traffic inspection with the OWASP Core Rule Set
- you need full HTTP audit logging and real-time security monitoring
When to avoid
- you need a cloud-managed or SaaS WAF without server-side deployment
- you want a modern Rust/Go WAF with a simpler configuration model (e.g., Coraza may fit better)
- you only need rate limiting or basic header filtering rather than full rule-based inspection
Facets
library · maturity stable
security http-server logging monitoring middleware security web-development backend apis cross-platform cpp waf web-application-firewall owasp nginx apache iis secrules http-traffic-inspection libmodsecurity linux web-server
5 sources
- readme: https://github.com/owasp-modsecurity/ModSecurity · fetched 2026-08-28 · 4332f09e4ef7
- homepage: https://www.modsecurity.org · fetched 2026-08-29 · 99f43d59ad8b
- site_page: https://modsecurity.org/20260629/about-cve-2026-52747-and-2026-52761 · fetched 2026-08-29 · 1ec9f8712e43
- site_page: https://modsecurity.org/20260428/about-cve-2026-30923-and-2026-42268 · fetched 2026-08-29 · 133cf0bb8ea9
- site_page: https://modsecurity.org/faq · fetched 2026-08-29 · c7faf6fc6f67
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| owasp-modsecurity/ModSecurity | main | 90 |
| owasp-modsecurity/ModSecurity-nginx | plugin | 59 |
For agents
markdown · JSON · MCP: product_card(name="owasp-modsecurity/ModSecurity")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem