WAF rules (Nginx, Apache, Traefik, Haproxy)

Patterns build · 2026-05-02

OWASP Core Rule Set coreruleset/coreruleset@v4.25.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.

Coverage: 646 patterns across 20 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.

Backends

Backend	Format	Bots	Archive	Size
Nginx	map + if	1803	nginx_waf.zip	52K
Apache	ModSecurity	1803	apache_waf.zip	60K
Traefik	Middleware TOML	1803	traefik_waf.zip	16K
HAProxy	ACL	1803	haproxy_waf.zip	44K

Quick install

curl -LO https://github.com/fabriziosalmi/patterns/releases/latest/download/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patterns

Integration guides → Nginx · Apache · Traefik · HAProxy

Verify (SHA-256)

539a8df9fec1164ba82e2b4ff6121825962d77c1e4d89c89e6bd6e38b18ce540  nginx_waf.zip
9fed94ad4613e3a47c9a823bcb92112e3e728c2db8c5e4d2f6443d70a04101d3  apache_waf.zip
d1ed3f0f14053405044dff33b04fd815d074b54a0465bb809bc11ff91222817b  traefik_waf.zip
52d68263ff6073cdf1b2ce19d1dbd81b939aea0875ff0c2cbc10ca35927e99f8  haproxy_waf.zip

echo "539a8df9fec1164ba82e2b4ff6121825962d77c1e4d89c89e6bd6e38b18ce540  nginx_waf.zip" | sha256sum -c -

---

Documentation · Source · Issues