OWASP Coraza WAF
OWASP Coraza WAF: A flexible self-hosted WAF for developers working across proxies, servers, and Go. Ranked #16 of 35 in Web Application Firewall Software by our editors (7.8/10); pricing: Free plan; best for developers needing open-source multi-proxy WAF protection.
At a glance
- Editor score7.8 / 10
- PricingFree plan
- Best forDevelopers needing open-source multi-proxy WAF protection
- Free planYes
- Paid fromFree
- Founded2021
- Facts checked20 Sep 2026
Where it wins
- Supports OWASP Core Rule Set and ModSecurity SecLang rules
- Protects REST, GraphQL, and gRPC endpoints
- Connects with Caddy, Envoy, HAProxy, Traefik, Apache, and NGINX
Where it doesn't
- Requires self-hosted deployment and operational ownership
- Rate limiting is not verified as a core Coraza capability
- Does not include AI features
Our verdict on OWASP Coraza WAF
OWASP Coraza WAF is an open-source Web Application Firewall framework written in Go. It is designed for developers protecting web applications and APIs in self-hosted environments, with deployment options that include a library, application server, reverse proxy, sidecar, or container. Its rule support covers ModSecurity SecLang and the OWASP Core Rule Set, while endpoint protection extends to REST, GraphQL, and gRPC. Custom rules, operators, actions, directives, audit logging, and logging backends provide control over how traffic is evaluated and recorded.
Coraza’s main advantage is its ecosystem fit. Official connectors and integrations support Caddy, Envoy, Istio, HAProxy, Traefik, Apache HTTP Server, NGINX, WebAssembly proxies, and Go applications. That range makes it suitable for teams standardizing protection across different proxy and server environments rather than adopting a hosted WAF tied to one platform. The open-source, free model also keeps the software accessible for teams prepared to manage deployment, configuration, rules, and logging themselves.
The trade-off is operational responsibility. Coraza is a self-hosted framework, not a hosted SaaS product, so it suits teams with the skills and infrastructure to run a WAF within their own application and proxy stack. Its strongest focus is rule-based web and API protection, custom policy control, and broad integration. Rate limiting is not verified as a core Coraza capability, and AI features are not included. Choose Coraza for open-source control, SecLang compatibility, and multi-proxy deployment options; consider an alternative when managed operations or built-in rate-limiting capabilities are central requirements.
Your product? Our editors can test OWASP Coraza WAF in depth and publish a review, labelled as paid · from $149/mo →
OWASP Coraza WAF pricing
OWASP Coraza WAF fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Deployment model | Not verified |
| Managed rule sets | Yes |
| API protection | Yes |
| Bot management | Yes |
| Rate limiting | Not verified |
| Log retention | Not verified |
| Deployment | Self-hosted |
| Platforms | Linux, macOS |
| Support | Community, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 9 integrations: Caddy, Envoy, Istio, HAProxy, Traefik, Apache HTTP Server … |
| Pricing | Free plan |
| Website | coraza.io |
| Facts checked | 20 Sep 2026 |
OWASP Coraza WAF integrations
OWASP Coraza WAF lists 9 integrations on its own site.
- Caddy
- Envoy
- Istio
- HAProxy
- Traefik
- Apache HTTP Server
- NGINX
- WebAssembly proxies
- Go applications
Alternatives to OWASP Coraza WAF
- Cloudflare WAFBroad edge WAF coverage with a free plan and Terraform management.9.4
- AWS WAFFlexible AWS-native protection with usage-based pricing that requires careful cost planning.9.2
- Wallarm WAAPA broad WAAP platform with a useful free tier for API-focused security teams.9.1
See all OWASP Coraza WAF alternatives →
Also Ranked In
OWASP Coraza WAF is ranked in 3 of our directories.
Used OWASP Coraza WAF? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OWASP Coraza WAF for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
OWASP Coraza WAF is listed in our Web Application Firewall Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/owasp-coraza-waf/"><img src="https://www.itechguides.com/best/badge/owasp-coraza-waf.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update