License & Deployment Mix: 16 tools – 9 OSS, 2 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
Overview
A Web Application Firewall (WAF) inspects HTTP/HTTPS traffic between clients and web applications to detect and block attacks at the application layer (OSI Layer 7). Unlike network firewalls that operate at Layers 3-4, a WAF understands HTTP semantics – headers, cookies, query parameters, request bodies, JSON/XML payloads – and applies rules to block malicious requests before they reach the application.
WAF platforms protect against:
- SQL injection – malicious SQL in form fields, query strings, or headers that manipulates database queries
- Cross-site scripting (XSS) – injected scripts that execute in other users’ browsers
- Cross-site request forgery (CSRF) – forged requests that trick authenticated users into performing unwanted actions
- Remote code execution (RCE) – payloads that exploit application vulnerabilities to execute arbitrary commands
- Path traversal – requests that access files
outside the web root (e.g.,
../../etc/passwd) - HTTP request smuggling – malformed requests that exploit differences between front-end and back-end HTTP parsing
- Bot management – distinguishing legitimate users from bots, scrapers, and credential stuffers
- API abuse – rate limiting, schema validation, and anomaly detection for REST/GraphQL APIs
- DDoS mitigation – Layer 7 DDoS protection (HTTP floods, slowloris, application-specific attacks)
WAFs typically operate in one of three modes:
- Reverse proxy – WAF sits between the client and the origin server; all traffic passes through the WAF
- Embedded module – WAF runs as a module inside the web server (e.g., ModSecurity in Nginx/Apache)
- Cloud / CDN-based – WAF runs at the CDN edge; traffic is filtered before reaching the origin
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Deployment Model
| Tool | Type | Self-Hosted | SaaS/Cloud | License |
|---|---|---|---|---|
| ModSecurity | Module | Yes | No | Apache 2.0 |
| Coraza | Module / Sidecar | Yes | No | Apache 2.0 |
| BunkerWeb | Reverse proxy | Yes | No | AGPL-3.0 |
| SafeLine | Reverse proxy | Yes | No | Apache 2.0 |
| open-appsec | Module / Sidecar | Yes | Yes | Apache 2.0 |
| Naxsi | Module | Yes | No | GPL-3.0 |
| Curiefense | Envoy filter | Yes | No | Apache 2.0 |
| Shadow Daemon | App connector | Yes | No | GPL-2.0 |
| OWASP CRS | Rule set | Yes | N/A | Apache 2.0 |
| Cloudflare WAF | CDN edge | No | Yes | Proprietary |
| AWS WAF | Cloud | No | Yes | Proprietary |
| Azure WAF | Cloud | No | Yes | Proprietary |
| Fastly WAF | CDN edge | No | Yes | Proprietary |
| Akamai Kona | CDN edge | No | Yes | Proprietary |
| Imperva WAF | Cloud | No | Yes | Proprietary |
| F5 NGINX App Protect | Module | Yes | No | Proprietary |
Detection Capabilities
| Tool | OWASP CRS | Custom Rules | ML/AI | Bot Mgmt | API Protection |
|---|---|---|---|---|---|
| ModSecurity | Yes | Yes (SecRule) | No | No | Limited |
| Coraza | Yes | Yes (SecRule) | No | No | Limited |
| BunkerWeb | Yes | Yes | No | Yes | Limited |
| SafeLine | No (own engine) | Yes | Yes | Yes | Yes |
| open-appsec | No (ML-based) | Yes | Yes | No | Yes |
| Naxsi | No (whitelist) | Yes | No | No | No |
| Cloudflare WAF | Yes* | Yes | Yes | Yes | Yes |
| AWS WAF | Yes* | Yes | Yes | Yes | Yes |
| Fastly WAF | No (SmartParse) | Yes | Yes | Yes | Yes |
| Imperva WAF | Yes* | Yes | Yes | Yes | Yes |
| F5 NAP | No (own sigs) | Yes | Yes | Yes | Yes |
* = managed rule sets based on or inspired by OWASP CRS
Traefik Integration
| Tool | Integration Method | Complexity |
|---|---|---|
| ModSecurity | Traefik plugin (community) | Medium |
| Coraza | Traefik Coraza plugin (native Go) | Low |
| BunkerWeb | Separate Nginx in front of Traefik | High |
| SafeLine | Separate proxy in front of Traefik | High |
| open-appsec | Nginx/Kong module; separate from Traefik | High |
| Cloudflare WAF | DNS proxy in front of Traefik | Low |
| AWS WAF | ALB/CloudFront in front of Traefik | Medium |
Recommended default: Coraza plugin for Traefik (lowest integration complexity, Go-native, OWASP CRS compatible) or Cloudflare WAF for internet-facing deployments.
SSO / Authentik Integration
| Tool | OIDC | SAML | Notes |
|---|---|---|---|
| BunkerWeb | No | No | Web UI; forward-auth via Traefik |
| SafeLine | No | No | Web UI; forward-auth via Traefik |
| Cloudflare WAF | Yes | Yes | Cloudflare Zero Trust SSO |
| AWS WAF | Yes | Yes | AWS IAM / SSO |
| Azure WAF | Yes | Yes | Entra ID SSO |
| Imperva WAF | No | Yes | SAML for cloud console |
| Fastly WAF | No | Yes | SAML for dashboard |
OSS WAFs (ModSecurity, Coraza, Naxsi) have no admin UI and therefore no SSO requirement.
Performance
| Tool | Latency Impact | Throughput | Notes |
|---|---|---|---|
| ModSecurity | Medium | Medium | Perl regex engine; CRS can be heavy |
| Coraza | Low | High | Go; faster than ModSecurity |
| Naxsi | Low | High | Lightweight whitelist model |
| Cloudflare WAF | Very low | Very high | Edge processing; no origin latency |
| AWS WAF | Low | High | Evaluated at ALB/CloudFront |
Tools
16 tools.
Akamai Kona Site Defender
Akamai Kona Site Defender (now part of Akamai App & API Protector) is an enterprise-grade cloud WAF delivered through Akamai’s global edge platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
AWS WAF
AWS WAF is Amazon Web Services’ cloud-native web application firewall. It integrates directly with AWS services (CloudFront, Application Load Balancer, API Gateway, AppSync) to inspect HTTP/HTTPS traffic at the edge or at the load balancer…
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Azure WAF
Azure WAF is Microsoft’s cloud-native web application firewall, available on Azure Application Gateway and Azure Front Door.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
BunkerWeb
BunkerWeb is an open-source web application firewall and reverse proxy built on Nginx, integrating ModSecurity with the OWASP Core Rule Set plus bot management, rate limiting, and automatic HTTPS via a web UI.
License: AGPL-3.0-only (OSS) · Kind: web · Deploy: docker, k8s · SSO: none
Cloudflare WAF
Cloudflare WAF is a cloud-based web application firewall integrated into Cloudflare’s global CDN and security platform.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Coraza
Coraza is a modern, open-source web application firewall engine written in Go, reimplementing ModSecurity’s SecRule language with full OWASP Core Rule Set compatibility; a CNCF Sandbox project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker, k8s · SSO: none
Curiefense
Curiefense is a cloud-native web application firewall and bot management platform built on Envoy Proxy. It was created by Reblaze (an application security company) and donated to the CNCF as a Sandbox project.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
F5 NGINX App Protect
F5 NGINX App Protect (NAP) is a commercial web application firewall that brings F5’s enterprise- grade BIG-IP Advanced WAF detection engine to the NGINX Plus platform.
License: Proprietary (proprietary) · Kind: web · Deploy: docker · SSO: none
Fastly WAF / Signal Sciences
Fastly WAF (formerly Signal Sciences, acquired by Fastly in 2020) is a next-generation web application firewall that uses a patented SmartParse detection engine instead of traditional regex pattern matching.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: none
Imperva WAF
Imperva (formerly Imperva SecureSphere, acquired by Thales in 2023) is a long-established application security vendor offering both cloud-based and on-premises WAF products.
License: Proprietary (proprietary) · Kind: web · Deploy: native, saas · SSO: none
ModSecurity
ModSecurity is the original open-source web application firewall engine, first released in 2002 by Ivan Ristic as an Apache HTTP Server module.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker, k8s · SSO: none
Naxsi
Naxsi (Nginx Anti XSS & SQL Injection) is a lightweight, whitelist-based web application firewall module for Nginx.
License: GPL-3.0-only (OSS) · Kind: web · Deploy: docker, package · SSO: none
open-appsec
open-appsec is a machine-learning-based web application firewall and API security platform that uses contextual ML models instead of traditional signature/rule-based detection.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
OWASP Core Rule Set (CRS)
The OWASP Core Rule Set (CRS) is the standard open-source rule set for ModSecurity-compatible web application firewalls. It provides generic attack detection rules that protect against the OWASP Top 10 and many other attack categories.
License: Apache-2.0 (OSS) · Kind: web · Deploy: saas, docker · SSO: none
SafeLine
SafeLine is a modern web application firewall developed by Chaitin Technology, a Chinese cybersecurity company founded in 2014.
License: Apache-2.0 (OSS) · Kind: web · Deploy: docker · SSO: none
Shadow Daemon
Shadow Daemon is an application-level web application firewall that operates inside the application runtime rather than at the network/proxy layer.
License: GPL-2.0-only (OSS) · Kind: web · Deploy: docker, package · SSO: none
