Web Security
WAF Tools Compared: 6 Web Application Firewalls for 2026
Buy time at the edge while the sink in the app still has to close. A WAF is no longer a substitute for fixing the assignment in the React tree.
Expertise: Web Security · Level: Intermediate · 6 min read
A WAF used to be the product you bought instead of fixing the sink. In 2026 it is time you bought. The assignment in the React tree still has to close.
The control teams already have is often a CDN checkbox. That checkbox can be green and still miss a request that is valid HTTP and a broken page.
Rules you can read, and an edge many teams already pay for, are different ways to buy that time. Then fix the sink. This shortlist is the filter, not the sanitizer in the template.
Self-hosted rule engines, cloud WAFs on the CDN you already use, and managed rule packs split how you buy that time. Pick the filter you can actually tune without waiting a quarter for a change ticket.
How we evaluated
We read first-party docs, source, licenses, and release notes, and we treat a marketing page as a claim, not as proof that two products do the same work.
We cared about whether you can read or write the rule, whether you operate the engine, whether it attaches to a front door you already have, and whether the docs treat it as a filter rather than a sanitizer.
We read first-party docs, licenses, and release notes. Unless a write-up says otherwise, we did not run a paid tenant.
| Tool | Best for | What to check |
|---|---|---|
| Coraza | Modern open WAF engine | Go engine · Apache-2.0 · you operate the proxy |
| ModSecurity | Classic open WAF | SecRule plus CRS · Apache-2.0 · connectors you run |
| Cloudflare WAF | Known edge WAF | Managed rulesets · Cloudflare plans · same edge as the CDN |
| AWS WAF | First-party WAF on AWS front doors | Managed rule groups · AWS consumption · AWS front doors |
| Fastly NGWAF | Signal Sciences under Fastly | Agent or edge deploy · commercial · not classic CRS |
| NAXSI | Nginx WAF module you compile | Nginx module · GPL-3.0 · you compile and tune |
Coraza
Best for modern open WAF engine
Coraza is a Go WAF engine compatible with ModSecurity-style rules. OWASP Core Rule Set can ride it.
An engine you can embed is a rule you can review. You still tune the core set. It is not a CDN. You own the false positives.
Key features
- Go engine
- CRS compatible path
- Apache-2.0
- You operate the proxy
Why we like it
An embeddable engine with a readable rule path is the open row you can prove on a host you own.
Limits
You still tune the core set. It is not a global edge. You own the false positives.
ModSecurity
Best for classic open WAF
ModSecurity is the classic. Apache and Nginx connectors, Core Rule Set. The repo moved under OWASP.
If the team already speaks SecRule, this is the engine they know. Tuning is a job. Version and connector mismatches still confuse installs. It is not a CDN.
Key features
- CRS ecosystem
- Connectors
- Long operator memory
- Apache-2.0
Why we like it
Operator memory on SecRule is why this engine stays on the list.
Limits
Tuning is a job. Connectors still confuse installs. Not a CDN.
Cloudflare WAF
Best for known edge WAF
Cloudflare WAF is the known edge. Rules sit on the proxy you already use for DNS.
If the site is already on Cloudflare, start here before you host Coraza. Plan SKUs hide rules. It does not fix the React sink. Open XSS defenses.
Key features
- Managed rulesets
- Custom rules
- Same edge as CDN
- Plan-gated
Why we like it
The filter on the DNS you already pay for is the practical first commercial move.
Limits
Plan SKUs hide rules. It does not fix the sink. Open XSS defenses.
AWS WAF
Best for first-party WAF on AWS front doors
AWS WAF attaches to Application Load Balancer, CloudFront, and API Gateway. Rules are AWS documents, not Core Rule Set by default.
If the front door is already CloudFront, this is the native filter. It is AWS-shaped. Rule groups cost. It is not a multi-cloud edge.
Key features
- Managed rule groups
- IP sets
- Attached to AWS fronts
- Consumption
Why we like it
A native filter on the front door you already run is the first-party AWS row.
Limits
AWS-shaped. Rule groups cost. Not a multi-cloud edge.
Fastly NGWAF
Best for signal Sciences under Fastly
Fastly NGWAF is the Signal Sciences product. It inspects requests with a different model than classic Core Rule Set.
Known commercial option when core-rule noise is the complaint. Still not a sanitizer.
Key features
- Agent or edge deploy
- Smart rules on the public docs
- API protection story
- Commercial
Why we like it
A different inspection model is the practical commercial answer when signature noise is the ticket pile.
Limits
Commercial. Still not a sanitizer.
NAXSI
Best for nginx WAF module you compile
NAXSI is a Nginx module. Learning mode, then enforce. Older, still the Nginx-native option on this list.
When the only proxy is Nginx you already run, a module beats a new CDN contract. You compile and tune. Score and learning are a process. It is not a global anycast edge.
Key features
- Nginx module
- Learning mode
- GPL-3.0
- You compile and tune
Why we like it
A module on the proxy you already compile is the no-new-edge row.
Limits
You staff it. Learning mode is a process. Not a global anycast edge.
What we left out
- Imperva. Enterprises already bought a classic commercial WAF. Three known edges already sit on this page, and a fourth quote-led option would unbalance the split.
- Azure Web Application Firewall. Azure front doors already have a native filter. AWS WAF already covers the first-party cloud row, and this page is not a second cloud console.
WAF threads on HN treat the edge as a leaky abstraction. We agree. The sink still lives in the app.
Questions before you buy
If a first-party page cannot answer these, keep shopping.
- Can I read the rule that would fire on a path I own?
- Are we attaching this to an edge we already pay for, or standing up a new proxy?
- Who tunes false positives in the first month, and on which environment?
Turn on the filter on the edge you already pay for. Then close the sink. Core-rule noise is a tune job.
FAQs
Does a WAF replace XSS defenses?
No. The sanitizer and Trusted Types stay in the app. Open XSS defenses.
Should I enable every CRS rule on day one?
No. That is the wrong door. Tune on an environment you own.
Is Cloudflare enough?
It is an edge. It is not the sink. Use it if you are already there. Still fix the app.
Is this a scored bake-off?
No. Order is editorial.
