Open Source Tools · Alternatives
Cloudflare WAF is a managed web application firewall running on Cloudflare's network. Self-hosted options include the ModSecurity and Coraza engines (usually with the OWASP Core Rule Set), BunkerWeb as a hardened reverse proxy and CrowdSec for behaviour-based blocking.
Cloudflare WAF is a commercial product by Cloudflare (official site). Category: WAF and edge protection.
| Tool | Licence | Stars | Last commit | Best for |
|---|---|---|---|---|
 CrowdSec | MITOpen source | 15k | today | Collaborative behaviour-based IPS |
 BunkerWeb | AGPL-3.0-onlyOpen source | 11k | 5 days ago | Nginx-based web application firewall |
 ModSecurity | Apache-2.0Open source | 9.8k | 4 days ago | Web application firewall engine |
 Coraza | Apache-2.0Open source | 3.9k | today | ModSecurity-compatible WAF library in Go |
Collaborative behaviour-based IPS
Security engine that parses logs to detect aggressive behaviour, blocks it with remediation components and shares signals in a community blocklist.
Nginx-based web application firewall
WAF and hardened reverse proxy based on Nginx, with ModSecurity and the OWASP CRS, bot protection and a web UI, for Docker, Kubernetes or Linux.
Web application firewall engine
Cross-platform WAF engine (libmodsecurity) for Apache, Nginx and IIS, typically used with the OWASP Core Rule Set. Now an OWASP project.
ModSecurity-compatible WAF library in Go
OWASP WAF library written in Go, compatible with ModSecurity SecLang rules and the OWASP Core Rule Set, embeddable in Go apps and proxies.
Product names are trademarks of their owners. ThreatWire is not affiliated with Cloudflare. The comparison covers what each tool is designed to do, not a feature-by-feature equivalence.
