Coraza is a Web Application Firewall library written in Go that provides ModSecurity-compatible protection for web applications.
Coraza addresses the need for high-performance application-layer security by implementing a WAF engine compatible with industry-standard SecLang rulesets. It runs the OWASP Core Rule Set v4 to defend against common attack categories including SQL injection, cross-site scripting, code injection, and bot detection. The tool is designed as a library at its core, allowing developers to embed it directly into Go applications or deploy it through various server integrations rather than requiring a separate WAF appliance.
Teams should adopt Coraza if they need WAF protection with minimal performance overhead and want to avoid vendor lock-in through standard rulesets. It suits projects ranging from small blogs to large websites and works across Linux, Windows, and macOS. The tool is particularly valuable for organizations already using Go or those deploying to environments like Kubernetes through proxy-wasm integrations with Envoy, or to reverse proxies like Caddy and Traefik. The README identifies it as an alternative to the OWASP ModSecurity Engine, with the key distinction being Coraza's Go implementation and broader ecosystem of maintained integrations.
Development activity shows consistent engagement with the community through GitHub Discussions and OWASP Slack channels. The project maintains multiple official integrations at varying maturity levels, with some marked as stable and others as experimental, indicating ongoing expansion of deployment options. Several integrations are explicitly noted as needing maintainers, suggesting the core team prioritizes community contribution over maintaining every plugin themselves.
