WAF tools that sit on the edge, not in the React sink (2026)

The rule fired on a path. The sink is still in the app. XSS defenses stay on Application Security. This page is the edge. A WAF can buy time. It cannot replace Trusted Types.

Six edges. Two open engines. Two cloud WAFs. One commercial NGWAF. One Nginx module. Public docs. Not a bake-off.

Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.

1

Coraza

Best for modern open WAF engine

Coraza · Apache-2.0

Coraza is a Go WAF engine compatible with ModSecurity-style rules. OWASP Corerules can ride it.

Key features

• Go engine
• CRS compatible path
• Apache-2.0
• You operate the proxy

Why we like it

This is the hidden gem. An engine you can embed is a rule you can test.

Limits

You still tune CRS. It is not Cloudflare. You own the false positives.

2

ModSecurity

Best for classic open WAF

OWASP · Apache-2.0

ModSecurity is the classic. Apache, Nginx connectors, CRS. The repo moved under OWASP.

Key features

• CRS ecosystem
• Connectors
• Long operator memory
• Apache-2.0

Why we like it

If the team already speaks SecRule, this is the engine they know.

Limits

Tuning is a job. v3 vs connectors still confuse installs. Not a CDN.

3

Cloudflare WAF

Best for known edge WAF

Cloudflare · commercial plans

Cloudflare WAF is the known edge. Rules sit on the proxy you already use for DNS.

Key features

• Managed rulesets
• Custom rules
• Same edge as CDN
• Plan-gated

Why we like it

If the site is already on Cloudflare, start here before you host Coraza.

Limits

Plan SKUs hide rules. It does not fix the React sink. Link XSS defenses.

4

AWS WAF

Best for first-party WAF on AWS front doors

Amazon · consumption

AWS WAF attaches to ALB, CloudFront, and API Gateway. Rules are AWS documents, not CRS by default.

Key features

• Managed rule groups
• IP sets
• Attached to AWS fronts
• Consumption

Why we like it

If the front door is already CloudFront, this is the native filter.

Limits

AWS-shaped. Rule groups cost. Not a multi-cloud edge.

5

Fastly NGWAF

Best for signal Sciences under Fastly

Fastly · commercial

Fastly NGWAF is the Signal Sciences product. Inspects requests with a different model than classic CRS.

Key features

• Agent or edge deploy
• Smart rules they document
• API protection story
• Commercial

Why we like it

Known commercial shelf when CRS noise is the complaint.

Limits

Commercial. We did not run it. Still not a sanitizer.

6

NAXSI

Best for nginx WAF module you compile

naxsi · GPL-3.0

NAXSI is a Nginx module. Learning mode, then enforce. Older, still the Nginx-native gem.

Key features

• Nginx module
• Learning mode
• GPL-3.0
• You compile and tune

Why we like it

When the only proxy is Nginx you already run, a module beats a new CDN contract.

Limits

You staff it. Score/learning is a process. Not a global anycast edge.

What the internet thinks about WAF tools

WAF threads on HN treat the edge as a leaky abstraction. We agree. The sink still lives in the app.

tptacek on Hacker News, Nov 2021: “Don’t build systems whose security depends on ModSecurity!”

Prove Coraza still ships Apache-2.0

Confirm Coraza still publishes Apache-2.0. Do not point a raw CRS set at production on the first day.

curl -fsS https://raw.githubusercontent.com/corazawaf/coraza/main/LICENSE | head -n 4

FAQs

Does a WAF replace XSS defenses?

No. The sanitizer and Trusted Types stay in the app. Link the XSS list.

Should I enable every CRS rule on day one?

No. That is the wrong door. Tune on an environment you own.

Is Cloudflare enough?

It is an edge. It is not the sink. Use it if you are already there. Still fix the app.

Is this a scored bake-off?

No. Order is editorial.