awesome-alternatives

compare

Coraza vs ModSecurity

The same facts for both, read from GitHub every night, and the relation a person reviewed.

CorazaModSecurity
LanguageGoC++
LicenceApache-2.0Apache-2.0
Stars3.9k9.8k
Latestv3.8.1v3.0.17
Last push2026-10-062026-10-03
Release cadenceabout 5 days between releasesabout 33 days between releases
Active contributors8 commit authors on the default branch in the last 90 days2 commit authors on the default branch in the last 90 days
Flagsnonenone

How they relate

  • Both replace Cloudflare WAF. Alternatives to Cloudflare WAF →

    PartialCorazaWAF library in Go, compatible with ModSecurity rules, embedded in Caddy, Envoy or your own proxy.

    PartialModSecurityWAF engine for nginx, Apache and IIS on your own servers, used with a rule set such as the OWASP CRS.