WAF rules (Nginx, Apache, Traefik, Haproxy)

Patterns build · 2026-06-13

OWASP Core Rule Set coreruleset/coreruleset@v4.27.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.

Coverage: 646 patterns across 20 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.

Backends

Backend	Format	Bots	Archive	Size
Nginx	map + if	1831	nginx_waf.zip	52K
Apache	ModSecurity	1831	apache_waf.zip	60K
Traefik	Middleware TOML	1831	traefik_waf.zip	20K
HAProxy	ACL	1831	haproxy_waf.zip	44K

Quick install

curl -LO https://github.com/fabriziosalmi/patterns/releases/latest/download/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patterns

Integration guides → Nginx · Apache · Traefik · HAProxy

Verify (SHA-256)

6669ddb118f15acc9869b0563f42c16c51d84d1d06fa4f9f7a02d25befd47f4a  nginx_waf.zip
fe7f63fdb7809649c081e810c4770fc0d715af0587e85f36f6d8d1bcbd8303c2  apache_waf.zip
402ed41bb4096f3500859850143294e4fc0fcf521e532eb1aeb4e7091caf86d0  traefik_waf.zip
58b14ca0ee74c69213a3671d830834238489ef08d38c0bc2483d7e6be0a678f1  haproxy_waf.zip

echo "6669ddb118f15acc9869b0563f42c16c51d84d1d06fa4f9f7a02d25befd47f4a  nginx_waf.zip" | sha256sum -c -

---

Documentation · Source · Issues