WAFWikiIndependent WAF intelligence
中文

WAFWiki index

Search WAFWiki

Type at least 2 characters to search the full research library.

Rule Set / Open Source WAF / OWASP

OWASP Core Rule Set WAF

OWASP CRS is not a standalone WAF product, but it is a key rule set used with WAF engines such as ModSecurity and Coraza.

See Hands-On EvidenceOpen Setup GuideOfficial Product Page

Quick answer

Should you shortlist OWASP Core Rule Set?

OWASP Core Rule Set is most relevant for Generic web attack coverage and CRS-compatible engines. Validate this main constraint before committing to a production design: Requires a compatible WAF engine.

Deployment
ModSecurity, Coraza, Compatible WAF engines
Pricing
Free
License
Open source

Data card

Pricing
Free
License
Open source
Deployment
ModSecurity, Coraza, Compatible WAF engines
Integrations
ModSecurity, Coraza
Last checked
2026-05-30

Best fit

  • Generic web attack coverage
  • CRS-compatible engines
  • Rule tuning

Potential limitations

  • Requires a compatible WAF engine
  • Needs tuning to reduce false positives

WAFWiki read

Community-maintained generic attack detection rules.

This profile is written for evaluation rather than promotion. Use it to understand where OWASP Core Rule Set fits, which assumptions need validation, and which alternatives deserve side-by-side testing.

Evaluation checklist

  • Choose a compatible engine such as ModSecurity or Coraza before evaluating CRS coverage.
  • Pin CRS version and paranoia level so false positives and rule hits can be reproduced.
  • Build a narrow exclusion workflow for parameters, paths, and rule IDs instead of disabling broad categories.
  • Plan rule updates and regression testing around representative application traffic.

Feature snapshot

OWASP Core Rule Set capabilities to verify

SQLi rulesXSS rulesProtocol anomaly detection

WAFWiki lab evidence

OWASP Core Rule Set results observed in the local test stack

ModSecurity vs Coraza Docker Test: 20 Request ResultsOriginal ModSecurity vs Coraza Docker comparison using the same OWASP CRS 4.25.0, upstream, and 20 HTTP decisions across clean, SQLi, XSS, query, and JSON cases.WAF JSON Body Test: ModSecurity vs CorazaHands-on JSON request-body test showing how ModSecurity and Coraza handled one clean body plus controlled SQLi-like and XSS-like fields under OWASP CRS 4.25.0.OWASP CRS False Positive Test: 12 Clean RequestsClean-traffic regression test for ModSecurity and Coraza with 12 HTTP 200 decisions, six input patterns, zero blocking mismatches, and one repeatable numeric Host warning.ModSecurity CRS Docker Smoke TestA reproducible local smoke test for OWASP CRS with ModSecurity and NGINX, covering clean traffic, a SQLi-like lab request, evidence logs, and rollout caveats.

FAQ

What is OWASP Core Rule Set best for?

OWASP Core Rule Set is commonly evaluated for Generic web attack coverage, CRS-compatible engines, Rule tuning.

Is OWASP Core Rule Set free?

OWASP Core Rule Set pricing path: Free. Always verify current pricing on the official website.

Sources