Build software better, together

chaitin / SafeLine

SafeLine is a self-hosted WAF(Web Application Firewall) / reverse proxy to protect your web apps from attacks and exploits.

Updated Sep 28, 2026
Go

crowdsecurity / crowdsec

Star

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

docker kubernetes security firewall blocklist waf cybersecurity intrusion-detection web-security intrusion-prevention anti-bot modsecurity web-application-firewall bot-detection threat-intelligence waap bot-protection ids-ips

Updated Oct 19, 2026
Go

bunkerity / bunkerweb

Star

🛡️ Open-source and cloud-native Web Application Firewall (WAF)

Updated Oct 20, 2026
Python

0xInfection / Awesome-WAF

Star

Everything about Web Application Firewalls (WAFs) from Security Standpoint! 🔥

security awesome firewall waf infosec awesome-list web-application-firewall waf-test bypass-waf waf-detection waf-bypass waf-testing waf-fingerprints

Updated Aug 26, 2026
Python

EnableSecurity / wafw00f

Star

WAFW00F allows one to identify and fingerprint Web Application Firewall (WAF) products protecting a website.

waf fingerprint waffit web-application-firewall

Updated Apr 19, 2026
Python

corazawaf / coraza

Star

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library

go golang http waf owasp modsecurity hacktoberfest web-application-firewall coraza coraza-waf owasp-crs coreruleset

Updated Oct 19, 2026
Go

Ekultek / WhatWaf

Star

Detect and bypass web application firewalls and protection systems

firewall detection waf web-application fingerprinting bypass web-application-firewall web-application-firewall-bypassing

Updated Aug 11, 2024
Python

wallarm / gotestwaf

Star

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

security waf owasp bugbounty web-application-firewall security-tools web-application-security security-testing graphql-security api-security rest-security grpc-security

Updated Sep 25, 2026
Go

openappsec / openappsec

Star

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

nginx kubernetes rate-limiting waf owasp kong application-security appsec web-application-firewall security-tools owasp-top-ten devsecops api-security nginx-proxy-manager threat-prevention

Updated Sep 6, 2026
C++

Safe3 / uusec-waf

Star

Industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.

Updated Oct 14, 2026
Shell

ADD-SP / ngx_waf

Star

Handy, High performance, ModSecurity compatible Nginx firewall module & 方便、高性能、兼容 ModSecurity 的 Nginx 防火墙模块

nginx recaptcha captcha waf openresty modsecurity web-application-firewall nginx-modules modsecurity-nginx hcaptcha

Updated Sep 26, 2026
C

JANUSEC Application Gateway provides secure access, including reverse proxy, K8S Ingress Controller, Automatic ACME Certificate, WAF, 5-Second Shield, CC Defense, OAuth2 Authentication, Global Server Load Balance, and Cookie Compliance etc. JANUSEC应用网关，提供安全的接入，包括反向代理、K8S Ingress Controller、自动化ACME证书、WAF、5秒盾、CC防御、OAuth2身份认证、GSLB负载均衡与Cookie合规等。

golang security acme gateway waf sql-injection application-security web-application-firewall port-forwarding gslb web-application-security web-ssh cookie-banner application-gateway load-balance janusec-application-gateway janusec k8s-ingress-controller cookie-compliance

Updated Jul 18, 2026
Go

chaitin / blazehttp

Star

BlazeHTTP 是一款简单易用的 WAF 防护效果测试工具。BlazeHTTP stands as a user-friendly WAF protection efficacy evaluation tool.

benchmark waf http-parser bypass web-application-firewall waf-test

Updated Jul 1, 2024
Go

Check-Risk-WAF / Check-Risk-WAF

Star

Check Risk WAF is an all-in-one Web Application Firewall with Anti-Bot and Anti-DDoS protection at L3, L4, and L7. Available on-premises or as SaaS, it protects web apps against OWASP Top 10 attacks, CWE vulnerabilities, botnets, and DoS/DDoS. Free and unlimited for everyone, forever for personal, non-commercial use.