Open Source WAF / WAF Engine / Rule-based WAF
ModSecurity Review
Independent ModSecurity review with OWASP CRS 4.25.0 Docker request results, JSON body evidence, clean-traffic findings, tuning risks, and Coraza alternatives.
Quick answer
ModSecurity review verdict
ModSecurity remains a key reference point for CRS-based WAF deployments. In WAFWiki's limited same-CRS Docker matrix it matched all ten expected decisions, while long-term fit still depends on connector support, tuning ownership, logs, and rollback.
- Score
- 3.8 / 5
- Best for
- CRS-based deployments, Legacy WAF stacks
- Updated
- 2026-07-26
Evaluation readiness
High ecosystem value and strong CRS relevance, balanced by heavier connector, tuning, and long-term operations ownership.
Best for
- CRS-based deployments
- Legacy WAF stacks
- Teams comfortable tuning rules
Watch out for
- Rule tuning can become time-consuming without strong logging and ownership.
- Connector choice and version compatibility affect the deployment experience.
- It is an engine-oriented path, not a managed edge security service.
Evaluation criteria
| Area | WAFWiki read |
|---|---|
| Deployment model | Engine plus connector plus rules, usually requiring more assembly than a packaged WAF. |
| Tuning | Powerful for teams that can manage CRS exclusions and audit logs. |
| Alternatives | Compare with Coraza for Go-native environments and SafeLine for packaged self-hosted WAF use. |
Hands-on test plan
- Deploy with OWASP CRS in detection-only mode first.
- Collect false positives for core user workflows.
- Tune narrow exclusions and retest rule coverage.
- Measure audit log volume and performance overhead.
Decision questions
- Do we have enough WAF rule-tuning experience?
- Which connector path is best supported for our reverse proxy?
- Would Coraza or a packaged WAF reduce operational complexity?
Alternatives
ModSecurity comparison pages
FAQ
What evidence supports this ModSecurity review?
The review combines ModSecurity and OWASP CRS documentation with WAFWiki's local CRS Docker evidence: a same-CRS 20-decision matrix, JSON body checks, clean-traffic regression, and sequential response-time snapshot. The tests cover one NGINX path, not every connector or production traffic shape.
What remains unverified about ModSecurity?
Connector compatibility, CRS version, paranoia level, request-body handling, and exclusion maintenance can materially change the result.