Awesome Open Source
Awesome Open Source


test docs docker Codacy Badge GitHub release (latest by date including pre-releases) Semantic Versioning 2.0.0

Notification Chat

English | 简体中文

Handy, High performance Nginx firewall module.

Why ngx_waf

  • Full-featured: The basic functions of the web application firewall are available.
  • Easy to install.
    • Only depends on the uthash library and can be installed directly through a package manager (e.g. apt).
    • No need to install other modules in advance.
  • Easy to use: directives are easy to understand and you can probably guess what they mean without reading the documentation.
  • High performance: In more extreme tests, QPS(Queries Per Second) is reduced by about 4% after starting this module. See the documentation for details of the tests.


  • SQL injection detection.
  • IPV4 and IPV6 support.
  • Anti Challenge Collapsar, it can automatically block malicious IP.
  • Exceptional allow on specific IP address.
  • Block the specified IP address.
  • Block the specified request body.
  • Exceptional allow on specific URL.
  • Block the specified URL.
  • Block the specified query string.
  • Block the specified UserAgent.
  • Block the specified Cookie.
  • Exceptional allow on specific Referer.
  • Block the specified Referer.




BSD 3-Clause License


  • uthash: This project uses some data structures from uthash.
  • libinjection: This module uses this project to detect SQL injections.
  • ngx_lua_waf: Most of the default rules of this module come from this.
  • nginx-book: Thanks for the tutorial provided by the author.
  • nginx-development-guide: Thanks for the tutorial provided by the author.

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
c (15,324
nginx (485