Overview
Mix (16 tools)
- License: 9 open source · 7 proprietary
- Hosting: 8 self-hosted · 5 SaaS · 3 both
A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic between clients and web applications to detect and block attacks at the application layer (OSI Layer 7). Unlike network firewalls that operate at Layers 3-4, a WAF understands HTTP semantics – headers, cookies, query parameters, request bodies, JSON/XML payloads – and applies rules to block malicious requests before they reach the application.
WAF platforms protect against:
- SQL injection – malicious SQL in form fields, query strings, or headers that manipulates database queries
- Cross-site scripting (XSS) – injected scripts that execute in other users’ browsers
- Cross-site request forgery (CSRF) – forged requests that trick authenticated users into performing unwanted actions
- Remote code execution (RCE) – payloads that exploit application vulnerabilities to execute arbitrary commands
- Path traversal – requests that access files
outside the web root (e.g.,
../../etc/passwd) - HTTP request smuggling – malformed requests that exploit differences between front-end and back-end HTTP parsing
- Bot management – distinguishing legitimate users from bots, scrapers, and credential stuffers
- API abuse – rate limiting, schema validation, and anomaly detection for REST/GraphQL APIs
- DDoS mitigation – Layer 7 DDoS protection (HTTP floods, slowloris, application-specific attacks)
WAFs typically operate in one of three modes:
- Reverse proxy – WAF sits between the client and the origin server; all traffic passes through the WAF
- Embedded module – WAF runs as a module inside the web server (e.g., ModSecurity in Nginx/Apache)
- Cloud / CDN-based – WAF runs at the CDN edge; traffic is filtered before reaching the origin
About this data & disclaimer
The information on these pages was researched by a combination of human review and large language models. This catalogue serves as a reference for the resources, applications, devices, deployment payloads, and other components that the ResorsIT platform integrates, deploys, and manages. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. This information is compiled on a best-effort basis: it may be incomplete, contain errors, and become out of date as tools, vendors, licences, and features change. Use this catalogue only as a starting point for your own research, and independently verify and review any tool carefully against your own requirements before relying on it.
Comparison
Deployment Model
| Tool | Type | Self-Hosted | SaaS/Cloud | License |
|---|---|---|---|---|
| ModSecurity | Module | Yes | No | Apache 2.0 |
| Coraza | Module / Sidecar | Yes | No | Apache 2.0 |
| BunkerWeb | Reverse proxy | Yes | No | AGPL-3.0 |
| SafeLine | Reverse proxy | Yes | No | Apache 2.0 |
| open-appsec | Module / Sidecar | Yes | Yes | Apache 2.0 |
| Naxsi | Module | Yes | No | GPL-3.0 |
| Curiefense | Envoy filter | Yes | No | Apache 2.0 |
| Shadow Daemon | App connector | Yes | No | GPL-2.0 |
| OWASP CRS | Rule set | Yes | N/A | Apache 2.0 |
| Cloudflare WAF | CDN edge | No | Yes | Proprietary |
| AWS WAF | Cloud | No | Yes | Proprietary |
| Azure WAF | Cloud | No | Yes | Proprietary |
| Fastly WAF | CDN edge | No | Yes | Proprietary |
| Akamai Kona | CDN edge | No | Yes | Proprietary |
| Imperva WAF | Cloud | No | Yes | Proprietary |
| F5 NGINX App Protect | Module | Yes | No | Proprietary |
Detection Capabilities
| Tool | OWASP CRS | Custom Rules | ML/AI | Bot Mgmt | API Protection |
|---|---|---|---|---|---|
| ModSecurity | Yes | Yes (SecRule) | No | No | Limited |
| Coraza | Yes | Yes (SecRule) | No | No | Limited |
| BunkerWeb | Yes | Yes | No | Yes | Limited |
| SafeLine | No (own engine) | Yes | Yes | Yes | Yes |
| open-appsec | No (ML-based) | Yes | Yes | No | Yes |
| Naxsi | No (whitelist) | Yes | No | No | No |
| Cloudflare WAF | Yes* | Yes | Yes | Yes | Yes |
| AWS WAF | Yes* | Yes | Yes | Yes | Yes |
| Fastly WAF | No (SmartParse) | Yes | Yes | Yes | Yes |
| Imperva WAF | Yes* | Yes | Yes | Yes | Yes |
| F5 NAP | No (own sigs) | Yes | Yes | Yes | Yes |
* = managed rule sets based on or inspired by OWASP CRS
Traefik Integration
| Tool | Integration Method | Complexity |
|---|---|---|
| ModSecurity | Traefik plugin (community) | Medium |
| Coraza | Traefik Coraza plugin (native Go) | Low |
| BunkerWeb | Separate Nginx in front of Traefik | High |
| SafeLine | Separate proxy in front of Traefik | High |
| open-appsec | Nginx/Kong module; separate from Traefik | High |
| Cloudflare WAF | DNS proxy in front of Traefik | Low |
| AWS WAF | ALB/CloudFront in front of Traefik | Medium |
Recommended default: Coraza plugin for Traefik (lowest integration complexity, Go-native, OWASP CRS compatible) or Cloudflare WAF for internet-facing deployments.
SSO / Authentik Integration
| Tool | OIDC | SAML | Notes |
|---|---|---|---|
| BunkerWeb | No | No | Web UI; forward-auth via Traefik |
| SafeLine | No | No | Web UI; forward-auth via Traefik |
| Cloudflare WAF | Yes | Yes | Cloudflare Zero Trust SSO |
| AWS WAF | Yes | Yes | AWS IAM / SSO |
| Azure WAF | Yes | Yes | Entra ID SSO |
| Imperva WAF | No | Yes | SAML for cloud console |
| Fastly WAF | No | Yes | SAML for dashboard |
OSS WAFs (ModSecurity, Coraza, Naxsi) have no admin UI and therefore no SSO requirement.
Performance
| Tool | Latency Impact | Throughput | Notes |
|---|---|---|---|
| ModSecurity | Medium | Medium | Perl regex engine; CRS can be heavy |
| Coraza | Low | High | Go; faster than ModSecurity |
| Naxsi | Low | High | Lightweight whitelist model |
| Cloudflare WAF | Very low | Very high | Edge processing; no origin latency |
| AWS WAF | Low | High | Evaluated at ALB/CloudFront |
Tools
16 tools.
Akamai Kona Site Defender
Akamai Kona Site Defender (now part of Akamai App & API Protector) is an enterprise-grade cloud WAF delivered through Akamai’s global edge platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
AWS WAF
AWS WAF is Amazon Web Services’ cloud-native web application firewall. It integrates directly with AWS services (CloudFront, Application Load Balancer, API Gateway, AppSync) to inspect HTTP/HTTPS traffic at the edge or at the load balancer…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Azure WAF
Azure WAF is Microsoft’s cloud-native web application firewall, available on Azure Application Gateway and Azure Front Door.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
BunkerWeb
BunkerWeb is an open-source web application firewall and reverse proxy built on Nginx, integrating ModSecurity with the OWASP Core Rule Set plus bot management, rate limiting, and automatic HTTPS via a web UI.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Cloudflare WAF
Cloudflare WAF is a cloud-based web application firewall integrated into Cloudflare’s global CDN and security platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Coraza
Coraza is a modern, open-source web application firewall engine written in Go, reimplementing ModSecurity’s SecRule language with full OWASP Core Rule Set compatibility; a CNCF Sandbox project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Curiefense
Curiefense is a cloud-native web application firewall and bot management platform built on Envoy Proxy. It was created by Reblaze (an application security company) and donated to the CNCF as a Sandbox project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
F5 NGINX App Protect
F5 NGINX App Protect (NAP) is a commercial web application firewall that brings F5’s enterprise- grade BIG-IP Advanced WAF detection engine to the NGINX Plus platform.
License: Proprietary (proprietary) · Kind: web · Deploy: docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Fastly WAF / Signal Sciences
Fastly WAF (formerly Signal Sciences, acquired by Fastly in 2020) is a next-generation web application firewall that uses a patented SmartParse detection engine instead of traditional regex pattern matching.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Vaulted credential
Imperva WAF
Imperva (formerly Imperva SecureSphere, acquired by Thales in 2023) is a long-established application security vendor offering both cloud-based and on-premises WAF products.
License: Proprietary (proprietary) · Kind: web · Deploy: direct, saas · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
ModSecurity
ModSecurity is the original open-source web application firewall engine, first released in 2002 by Ivan Ristic as an Apache HTTP Server module.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Naxsi
Naxsi (Nginx Anti XSS & SQL Injection) is a lightweight, whitelist-based web application firewall module for Nginx.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: docker, package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
open-appsec
open-appsec is a machine-learning-based web application firewall and API security platform that uses contextual ML models instead of traditional signature/rule-based detection.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
OWASP Core Rule Set (CRS)
The OWASP Core Rule Set (CRS) is the standard open-source rule set for ModSecurity-compatible web application firewalls. It provides generic attack detection rules that protect against the OWASP Top 10 and many other attack categories.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
SafeLine
SafeLine is a modern web application firewall developed by Chaitin Technology, a Chinese cybersecurity company founded in 2014.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
Shadow Daemon
Shadow Daemon is an application-level web application firewall that operates inside the application runtime rather than at the network/proxy layer.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: docker, package · SSO: none
ResorsIT usage: Web App without SSO
Access & Identity: Forward-auth · Vaulted credential
