coraza

Coraza is a web application firewall engine: it inspects HTTP requests for SQL injection, XSS, and the rest of the attack alphabet before they reach your app. It's an OWASP project written in Go, fully compatible with ModSecurity's rule language and the OWASP Core Rule Set, and free under Apache 2.0.

You don't run Coraza by itself; you embed it in a proxy. The mature paths are a Caddy build with the Coraza plugin or Envoy via proxy-wasm, then loading the Core Rule Set. The install is the easy half. The work is tuning: every real application trips false positives until you've spent quality time with exclusion rules.

Solo and small teams wanting an appliance with a dashboard should use chaitin/SafeLine instead; Coraza has no UI. Platform and infrastructure teams get exactly what they want here: a maintained, embeddable WAF engine without betting on ModSecurity, whose corporate support ended and left it in maintenance mode.

The catch: a WAF engine without tuned rules is a false-positive machine. Run it in detection-only mode against production traffic before you even think about blocking.