# Coraza

Web application firewall library written in Go that runs ModSecurity SecLang rule sets, including the OWASP Core Rule Set, inside web servers and proxies.


Source: https://findsoftware.frbit.cloud/coraza/
Last reviewed: 2026-10-28
Listed since: 2026-10-28

## Record

### Links

- home: https://www.coraza.io
- repository: https://github.com/corazawaf/coraza
- docs: https://www.coraza.io/docs/tutorials/introduction/
- x: https://twitter.com/corazaio
- forum: https://github.com/corazawaf/coraza/discussions

### Identity

- status: active
- maintainer: OWASP Foundation, Inc.
- maintainerType: foundation
- parent: unknown
- firstRelease: 2021
- hqCountry: unknown

### Kind

- category: web-server
- hosting: binary
- language: go
- runtime: binary
- runtimeMin: unknown
- basedOn: unknown

### Content

- contentStore: not applicable
- databases: not applicable
- adminUi: not applicable
- headlessApi: not applicable
- templating: not applicable
- i18n: not applicable

### Rendering and deploy

- runsAs: unknown
- renderingModes: not applicable
- installMethod: go module

### License

- licenseModel: open-source
- license: Apache-2.0

### Releases

- currentMajor: 3
- latestReleaseDate: 2026-10-02

### Adoption

- githubStargazers: 3972
- packagistDownloads: not applicable
- npmWeeklyDownloads: not applicable
- contributors: 58
- pluginCount: unknown
- packagistMonthlyDownloads: unknown
- ecosystemsMonthlyDownloads: unknown
- httpArchiveSites: unknown
- wordpressActiveInstalls: unknown
- dependentRepos: unknown
- dependentPackages: unknown

### Sources

- urls: https://www.coraza.io/ (read 2026-10-28)
- urls: https://api.github.com/repos/corazawaf/coraza (read 2026-10-28)
- urls: https://www.coraza.io/docs/tutorials/introduction/ (read 2026-10-28)
- firstRelease: https://github.com/corazawaf/coraza/releases (read 2026-10-28)
- maintainer: https://owasp.org/about/ (read 2026-10-28)
- maintainerType: https://owasp.org/about/ (read 2026-10-28)
- category: https://github.com/corazawaf/coraza/blob/main/README.md (read 2026-10-28)
- language: https://api.github.com/repos/corazawaf/coraza (read 2026-10-28)
- runtime: https://github.com/corazawaf/coraza/blob/main/README.md (read 2026-10-28)
- installMethod: https://github.com/corazawaf/coraza/blob/main/README.md (read 2026-10-28)
- currentMajor: https://github.com/corazawaf/coraza/releases/tag/v3.8.1 (read 2026-10-28)
- latestReleaseDate: https://github.com/corazawaf/coraza/releases/tag/v3.8.1 (read 2026-10-28)
- license: https://api.github.com/repos/corazawaf/coraza (read 2026-10-28)
- licenseModel: https://github.com/corazawaf/coraza/blob/main/README.md (read 2026-10-28)
- githubStargazers: https://api.github.com/repos/corazawaf/coraza (read 2026-10-28)
- contributors: https://api.github.com/repos/corazawaf/coraza/contributors?per_page=1 (read 2026-10-28)

## Notes

Coraza is a web application firewall library written in Go. It runs rule sets written in SecLang, the rule language of ModSecurity, including the OWASP Core Rule Set. At its core it is a library: a Go program imports it, and the Coraza Project maintains integrations that place it inside an existing server or proxy, among them Caddy, Envoy through proxy-wasm, HAProxy, Traefik and NGINX through a C library.

The OWASP Foundation maintains the project as an OWASP Production Project. Development happens in the public GitHub repository, and questions go to GitHub Discussions.

## Worth knowing

The integrations do not share one stability status. The docs introduction and the README disagree on the HAProxy and Traefik integrations, and the Caddy plugin is marked as needing a maintainer. A reader choosing an integration should check its own repository and status before relying on it.

The README lists a Linux distribution or macOS as prerequisites and says Windows is not supported yet.

---

Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attributes are recorded, never scored; absent means unknown.
Credit, in full: FindSoftware, CC BY 4.0