OWASP ModSecurity
ModSecurity is the standard open-source web application firewall (WAF) engine. Originally designed as a module for the Apache HTTP Server, it has evolved to provide HTTP request and response filtering capabilities across a number of different platforms including Apache HTTP Server, Microsoft IIS and Nginx. It is free software released under the Apache license 2.0 and remains the most widespread open source web application firewall engine used by businesses, government organizations, internet service providers and commercial WAF vendors alike.
The OWASP ModSecurity project provides the WAF engine. The engine is usually coupled with OWASP CRS, the dominant WAF rule set, that brings protection against HTTP attacks.
About OWASP ModSecurity
Road Map
The project, started in 2002, is being transferred from Trustwave to OWASP in February 2024.
This will bring new life to ModSecurity and foster the creation of a development community around it.
It is one of the tasks of the new OWASP ModSecurity project to define a new road map.
Communication
The website at www.modsecurity.org is in the hands of Trustwave. They plan to hand over the domain and the website in Summer 2024.
Until that happens, this page here will serve as intermediary website of the project.
Communication currently happens on the #project-modsecurity channel on the OWASP Slack (the channel is public and you can get an invitation to the Slack here).
Project Resources
Project Information
Production Project
Classification
WAF
Language
C++
License
Apache 2.0
Latest Version
3.0.16
Contributors
101
GitHub Stars
9800
Related Projects
OWASP is a nonprofit foundation improving software security through open-source projects, global communities, and education. All resources are free and open to everyone.
SlackOWASP, the OWASP logo, and Global AppSec are registered trademarks and AppSec Days, AppSec California, AppSec Cali, SnowFROC, OWASP Boston Application Security Conference, and LASCON are trademarks of the OWASP Foundation, Inc.
© 2026, OWASP Foundation Inc. All rights reserved.