GitHub is where WAF projects prove themselves in production. Stars, commits, releases, issue resolution — the public record tells you more than any vendor comparison page. Here are five self-hosted WAFs worth your time, ranked by what they actually deliver.
1. SafeLine — 17K+ Stars
The most-starred WAF on GitHub. Deployed as Docker containers with a clean web dashboard, SafeLine uses semantic analysis rather than signature matching — it parses the grammatical structure of HTTP requests to distinguish attacks from legitimate traffic.
Detection rate: 71.65% with 0.07% false positives (BlazeHTTP benchmark).
Install:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Best for: Teams that want strong protection out of the box with minimal tuning. Community Edition is free for up to 10 applications.
2. BunkerWeb — NGINX-Based, Feature-Rich
Built on NGINX with ModSecurity + OWASP CRS integration. Includes a web UI, automatic Let's Encrypt, antibot challenges (Captcha, reCAPTCHA, hCaptcha), and Docker/K8s support.
Best for: Users who want the OWASP CRS ecosystem with a modern GUI and container-native deployment.
Weakness: Detection depends on ModSecurity rules, which generate a 17.58% false positive rate without extensive tuning.
3. Coraza — The Modern ModSecurity Replacement
An OWASP project written in Go. Drop-in compatible with ModSecurity SecLang rules and 100% compatible with OWASP CRS v4. Integrates with Caddy, Envoy, HAProxy, and Nginx.
Best for: Teams already invested in ModSecurity/CRS who want better performance without changing their rule sets.
Weakness: No built-in UI. You'll need separate tooling for dashboards and log analysis.
An IDS/IPS with a WAF component driven by community-sourced threat intelligence. Over 110,000 machines share IP reputation data, creating a continuously updated blocklist. The WAF uses virtual patching — blocks known-bad request patterns with near-zero false positives.
Best for: Teams that want crowd-sourced IP blocking alongside WAF capability. MIT-licensed and free.
Weakness: The WAF component is newer and less comprehensive than dedicated WAFs. Better paired with something like SafeLine or Coraza.
Built on Cloudflare's Pingora proxy library in Rust. Supports HTTP/1.1, HTTP/2, HTTP/3 (QUIC), 644+ built-in rules, OWASP CRS, ModSecurity rule import, and a Vue 3 admin UI. Extremely fast — sub-millisecond latency on clean traffic.
Best for: Teams that need maximum throughput and want to stay in the Rust/Pingora ecosystem.
Weakness: Newer project with a smaller community. Documentation is still catching up to features.
Benchmark Comparison
| WAF | Detection | False Positives | Dashboard | Setup |
|---|
| SafeLine | 71.65% | 0.07% | Yes - Clean GUI | One command |
| ModSecurity + CRS | 69.74% | 17.58% | No - Third-party | Hours of tuning |
| BunkerWeb | ~65% | ~10% | Yes - Web UI | Docker Compose |
| CrowdSec WAF | Varies | Near-zero | No | Module install |
| Coraza + CRS | ~65% | ~10% | No | Library/plugin |
FAQ
Which has the easiest setup?
SafeLine. One command, no rule tuning required. BunkerWeb is second — Docker Compose with env vars.
Which is best for production?
SafeLine or Coraza. SafeLine if you want a GUI and low false positives out of the box. Coraza if you need CRS compatibility and are comfortable without a UI.
Is ModSecurity still worth using?
Only if you're already deeply invested in it and have your rules finely tuned. For new deployments, Coraza gives you CRS compatibility with better performance and a modern codebase.
Do I need to choose just one?
No. SafeLine for application-layer inspection, CrowdSec for IP reputation, and Cloudflare for CDN/DDoS — layered defense.
Which matters more when evaluating a WAF — detection rate, false positives, or ease of setup?
Try SafeLine WAF — self-hosted Community Edition, free for up to 10 apps.
Live Demo | GitHub | Deploy Guide | Discord
