GitHub is where WAF projects prove themselves in production. Stars, commits, releases, issue resolution — the public record tells you more than any vendor comparison page. Here are five self-hosted WAFs worth your time, ranked by what they actually deliver.
1. SafeLine — 17K+ Stars
The most-starred WAF on GitHub. Deployed as Docker containers with a clean web dashboard, SafeLine uses semantic analysis rather than signature matching — it parses the grammatical structure of HTTP requests to distinguish attacks from legitimate traffic.
Detection rate: 71.65% with 0.07% false positives (BlazeHTTP benchmark).
Install:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Best for: Teams that want strong protection out of the box with minimal tuning. Community Edition is free for up to 10 applications.
2. BunkerWeb — NGINX-Based, Feature-Rich
Built on NGINX with ModSecurity + OWASP CRS integration. Includes a web UI, automatic Let's Encrypt, antibot challenges (Captcha, reCAPTCHA, hCaptcha), and Docker/K8s support.
Best for: Users who want the OWASP CRS ecosystem with a modern GUI and container-native deployment.
Weakness: Detection depends on ModSecurity rules, which generate a 17.58% false positive rate without extensive tuning.
3. Coraza — The Modern ModSecurity Replacement
An OWASP project written in Go. Drop-in compatible with ModSecurity SecLang rules and 100% compatible with OWASP CRS v4. Integrates with Caddy, Envoy, HAProxy, and Nginx.
Best for: Teams already invested in ModSecurity/CRS who want better performance without changing their rule sets.
Weakness: No built-in UI. You'll need separate tooling for dashboards and log analysis.
4. CrowdSec — Community-Powered Threat Intelligence
An IDS/IPS with a WAF component driven by community-sourced threat intelligence. Over 110,000 machines share IP reputation data, creating a continuously updated blocklist. The WAF uses virtual patching — blocks known-bad request patterns with near-zero false positives.
Best for: Teams that want crowd-sourced IP blocking alongside WAF capability. MIT-licensed and free.
Weakness: The WAF component is newer and less comprehensive than dedicated WAFs. Better paired with something like SafeLine or Coraza.
5. PRX-WAF — High-Performance on Pingora
Built on Cloudflare's Pingora proxy library in Rust. Supports HTTP/1.1, HTTP/2, HTTP/3 (QUIC), 644+ built-in rules, OWASP CRS, ModSecurity rule import, and a Vue 3 admin UI. Extremely fast — sub-millisecond latency on clean traffic.
Best for: Teams that need maximum throughput and want to stay in the Rust/Pingora ecosystem.
Weakness: Newer project with a smaller community. Documentation is still catching up to features.
Benchmark Comparison
| WAF | Detection | False Positives | Dashboard | Setup |
|---|---|---|---|---|
| SafeLine | 71.65% | 0.07% | Yes - Clean GUI | One command |
| ModSecurity + CRS | 69.74% | 17.58% | No - Third-party | Hours of tuning |
| BunkerWeb | ~65% | ~10% | Yes - Web UI | Docker Compose |
| CrowdSec WAF | Varies | Near-zero | No | Module install |
| Coraza + CRS | ~65% | ~10% | No | Library/plugin |
FAQ
Which has the easiest setup?
SafeLine. One command, no rule tuning required. BunkerWeb is second — Docker Compose with env vars.
Which is best for production?
SafeLine or Coraza. SafeLine if you want a GUI and low false positives out of the box. Coraza if you need CRS compatibility and are comfortable without a UI.
Is ModSecurity still worth using?
Only if you're already deeply invested in it and have your rules finely tuned. For new deployments, Coraza gives you CRS compatibility with better performance and a modern codebase.
Do I need to choose just one?
No. SafeLine for application-layer inspection, CrowdSec for IP reputation, and Cloudflare for CDN/DDoS — layered defense.
Which matters more when evaluating a WAF — detection rate, false positives, or ease of setup?
Related reads:
- SafeLine vs Cloudflare WAF: An Honest, Detailed Comparison — detection benchmarks and cost breakdown
- How to Replace Cloudflare WAF with a Self-Hosted Alternative — migration walkthrough
Try SafeLine WAF — self-hosted Community Edition, free for up to 10 apps.
Live Demo | GitHub | Deploy Guide | Discord
Top comments (2)
Good comparison. I’d add one criterion that often matters more than raw detection rates in production: operability. A WAF isn’t just about blocking attacks—it’s about how quickly teams can investigate false positives, tune policies, integrate logs into their SIEM, automate configuration changes, and safely roll out rule updates. A solution with slightly lower detection but excellent observability and maintainability can outperform a “better” engine over the long run. That’s usually where production deployments succeed or fail.
You're right. I think I should bring this up with our product team. The WAF itself doesn't provide operational services per se, but it absolutely needs to offer solid APIs, structured data exports, and the right hooks so ops teams can do their job efficiently.