ModSecurity

At a glance

• Editor score
  7.6 / 10
• Pricing
  Free plan
• Best for
  Operators wanting a free, configurable WAF engine
• Free plan
  Yes
• Paid from
  Free
• Founded
  2002
• Facts checked
  24 Sep 2026

• Where it wins

  • Filters HTTP requests and responses with configurable SecRules.
  • Supports proxy or in-server deployment with Apache, Nginx and IIS.
  • Monitors, logs and analyzes traffic, with blocking and redirection options.

• Where it doesn't

  • It is an engine; connectors and rule sets are separate projects.
  • Deployment is self-hosted rather than managed.
  • Optional SQL injection and XSS operators require libinjection.

Our verdict on ModSecurity

ModSecurity is an open-source web application firewall engine maintained as an OWASP Production project. It is suited to operators who want to filter HTTP requests and responses on infrastructure they manage, rather than use a managed WAF. Configurable SecRules can support traffic filtering, blocking, redirection, monitoring, logging and real-time analysis. It is listed for small, mid-market and enterprise organizations, though its self-hosted model means teams need to handle deployment and operation themselves.

The v3 library uses a connector architecture and integrates with Apache HTTP Server, Nginx and Microsoft IIS. It can run as a proxy in front of an application or inside a web server, giving teams these two deployment patterns. ModSecurity is also commonly paired with the OWASP Core Rule Set for operational protections. The engine, connectors and rule sets are separate projects, so prospective adopters should account for configuring and maintaining the surrounding components, rather than treating ModSecurity as a complete managed service.

ModSecurity is free and open source under Apache 2.0; its published offering is an engine rather than a paid tier structure. Optional SQL injection and XSS detection operators are available via libinjection. Community support and documentation are the listed support channels. This makes ModSecurity a fit for teams prepared to choose connectors and rules, configure SecRules, and run a WAF themselves. Organizations seeking a managed WAF or a bundled service with broader listed capabilities should compare alternatives; those wanting a configurable self-hosted engine can consider ModSecurity.

Your product? Our editors can test ModSecurity in depth and publish a review, labelled as paid · from $149/mo →

ModSecurity pricing

ModSecurity fact sheet

ModSecurity integrations

ModSecurity lists 4 integrations on its own site.

• Apache HTTP Server
• Nginx
• Microsoft IIS
• OWASP Core Rule Set

Alternatives to ModSecurity

• Akamai App & API ProtectorA broad edge security suite for hybrid application and API environments.9.3
• AWS WAFBroad AWS-native WAF controls with a low entry price and usage-based costs.9.2
• Imperva Web Application FirewallManaged WAF rules, bot controls and deployment automation for hybrid environments.9.1

See all ModSecurity alternatives →

Featured on iTechGuides

ModSecurity is listed in our Web Security Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/modsecurity-web-security-software-product/"><img src="https://www.itechguides.com/best/badge/modsecurity-web-security-software-product.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update