WAF rules (Nginx, Apache, Traefik, Haproxy)

Patterns build · 2026-07-22

OWASP Core Rule Set coreruleset/coreruleset@v4.28.0 converted into native WAF rules for four web servers. Generated automatically; no manual edits.

Coverage: 646 patterns across 20 categories — SQLi, XSS, RCE, LFI, RFI, plus generic anomaly and protocol-violation rules.

Backends

Backend	Format	Bots	Archive	Size
Nginx	map + if	1870	nginx_waf.zip	52K
Apache	ModSecurity	1870	apache_waf.zip	64K
Traefik	Middleware TOML	1870	traefik_waf.zip	20K
HAProxy	ACL	1870	haproxy_waf.zip	44K

Quick install

curl -LO https://github.com/fabriziosalmi/patterns/releases/latest/download/nginx_waf.zip
unzip nginx_waf.zip -d /etc/nginx/waf_patterns

Integration guides → Nginx · Apache · Traefik · HAProxy

Verify (SHA-256)

4bb565fc662c4e849f220c1c7f537844837a28f4de21af401b4282280a30095b  nginx_waf.zip
405179c4fc1b4d16150b84ec550f22f8947124615ea2f45dc81f2d23dfc53f59  apache_waf.zip
4881a90b49a1de1a2fe0701d0280335fad95a53ce95da1921f37c2999f450c9a  traefik_waf.zip
633142fb38dec312b22a23c9bc22a6b49c8d09276b98a55fd110da99fab72efe  haproxy_waf.zip

echo "4bb565fc662c4e849f220c1c7f537844837a28f4de21af401b4282280a30095b  nginx_waf.zip" | sha256sum -c -

---

Documentation · Source · Issues