High-performance web application protection powered by the OWASP Core Rule Set. A single binary — deployed in minutes on any server.
HA-WAF combines all security components into one solution with zero external dependencies.
Embedded Coraza WAF engine with up-to-date OWASP Core Rule Set rules. Detection and prevention modes, paranoia levels 1–4, configurable anomaly threshold. Blocks SQL Injection, XSS, RCE, LFI and hundreds of other attacks.
Allow or block traffic by country of origin — configured independently per site. Whitelist of allowed countries, auto-update of the GeoIP map from a URL, X-Country header forwarded to the backend.
Let's Encrypt integration via ACME. Supports HTTP-01 and DNS-01 challenges, multi-account ACME configuration, certificate management UI. Upload custom PEM files per site.
Flexible request throttling: by connection count, HTTP request rate, or bytes-in rate. Configurable per site and per path — using prefix, exact match, or regex scoping.
Per-site CIDR whitelists and blacklists. Whitelist entries support a WAF bypass flag for trusted sources. Automatic IP ban when the WAF hit threshold is exceeded — configurable threshold and duration, responds with 429.
Flexible request routing: proxy, return, and redirect actions. Match by prefix, exact, regex, or suffix. Native WebSocket and gRPC support. Load balance across multiple upstreams, manipulate headers, apply per-path rate limits.
Domain list files (.lst) with optional URL sync — for routing traffic to different backends. Specific domains can be excluded from WAF inspection directly in WAFPolicy without changing rules.
Write SecRule/SecAction directives globally or per site with priority ordering. CRS rule exclusions: disable, exclude_arg, exclude_request_header, exclude_url. Full ModSecurity-compatible syntax.
Native OpenTelemetry support: traces, metrics, and logs via OTLP gRPC. Ready-made integrations with Grafana, VictoriaMetrics, and VictoriaLogs. Prometheus /metrics endpoint.
Multi-provider OIDC/SSO, local users, and API keys. Viewer and admin roles. Full action audit trail for security compliance.
Full configuration snapshots with diff view and one-click rollback. Export and import the entire configuration as JSON — for backups and server-to-server migration.
Full-featured REST API with OpenAPI specification. Multi-language web interface (RU/EN). Custom TCP/HTTP/HTTPS listeners on non-standard ports with optional WAF. SQLite (default, zero-config) or PostgreSQL.
HA-WAF manages all components as a single process — no complex orchestration, no external dependencies.
High-performance inbound traffic handling, SSL termination, load balancing across backends, and path-based routing.
Embedded Coraza WAF with OWASP CRS inspects every request in real time via the SPOE protocol.
HTTP API on port 8080 and a built-in web interface. SQLite (zero-config default) or PostgreSQL for configuration storage.
Built-in Let's Encrypt client supporting HTTP-01 and DNS-01 challenges, multi-account setup, and automatic certificate renewal.
Everything you need to get started quickly, fine-tune your configuration, and integrate HA-WAF into your infrastructure.
Protect internal and external web services. Meet security compliance requirements without expensive commercial solutions. SSO, roles, and audit trail included.
Block scrapers, automated attacks, and fraud. Apply rate limiting to checkout and API endpoints. Enforce geo-restrictions with GeoIP filtering.
Healthcare, finance, government — where data cannot be entrusted to a foreign cloud WAF vendor. Fully on-premises, zero data leaves your network.
Fast setup with minimal configuration. Scales from a single VPS to a high-traffic cluster. SQLite by default — zero infrastructure dependencies to start.
Protect APIs from abuse, injections, and DDoS. Flexible rules scoped to URL paths and request headers. Native gRPC and WebSocket support.
Full data sovereignty. Deploy via Docker, systemd, or Kubernetes (Helm Chart). No dependency on external services.
HA-WAF runs inside your infrastructure — full control over data and configuration, no cloud dependencies.
Ready-to-use image for rapid deployment in any container environment
Pre-built service configuration to run as a system service on any Linux server
Full stack with OTel Collector, VictoriaMetrics, and Grafana in a single command
Official Helm chart with HPA, PodDisruptionBudget, Ingress, and HTTPRoute. Flux CD manifests included.
Submit a request — we'll help with setup and answer integration questions.
No spam. Only deployment help and notifications about important updates.