WAFWikiIndependent WAF intelligence
中文

WAFWiki index

Search WAFWiki

Type at least 2 characters to search the full research library.

WAF shortlist

Best Self-Hosted WAF

A shortlist of self-hosted WAF products, engines, and rule sets for teams that want local control over application traffic.

Selection criteria

  • Self-hosted deployment path
  • Operational clarity
  • Rule and policy control
  • Rollback planning

Who this helps

Teams that want local control over traffic inspection instead of a fully managed edge service.

1

Packaged self-hosted WAF

SafeLine

Useful when teams want a deployable WAF product rather than only a WAF engine.

2

Integrated web server security stack

BunkerWeb

Relevant where web serving and WAF-like controls should live close together.

3

Open-source WAF engine

ModSecurity

A classic option for teams prepared to manage connectors, rules, and tuning.

4

Embeddable WAF engine

Coraza

Strong fit when a team wants to integrate WAF behavior into Go-native or custom gateways.

Ranking note

Shortlists are not universal rankings.

The shortlist favors local traffic control and inspectable operations. Teams should rank candidates again using their own automation, staffing, observability, backup, and emergency bypass maturity.

Related research

Validate the Best Self-Hosted WAF shortlist

SafeLine WAF ReviewIndependent review and readiness score.ModSecurity ReviewIndependent review and readiness score.SafeLine WAF Docker Install GuideDeployment workflow and validation steps.ModSecurity with NGINX and OWASP CRS Setup GuideDeployment workflow and validation steps.Coraza Caddy Docker Setup and CRS Validation GuideDeployment workflow and validation steps.SafeLine vs CorazaCompare shortlist candidates side by side.SafeLine vs ModSecurityCompare shortlist candidates side by side.SafeLine vs Cloudflare WAFCompare shortlist candidates side by side.

Sources