Comparative Analysis of Six Free Web Application Firewalls Using Realistic Traffic

The article presents a comparative evaluation of six popular free or open-source Web Application Firewalls (WAFs): SafeLine, Coraza, ModSecurity, Baota, nginx-lua-waf, and SuperWAF. The motivation behind the study comes from the need to choose reliable WAF solutions for clients, given their critical role in blocking attacks like SQL injection, remote code execution, and cross-site scripting.

A consistent, transparent methodology was applied: Four key metrics were measured—Detection Rate (ability to block attacks), False Positive Rate (accidental blocking of normal traffic), Accuracy Rate (balance of blocking attacks and allowing normal traffic), and Detection Latency (response speed). The tests used both legitimate web traffic (over 60,000 real HTTP requests) and 600 attack payloads derived from open security tools and public datasets, with roughly a 100:1 ratio of normal to malicious requests to simulate real-world conditions. All WAFs ran with default settings on a standardized Nginx server setup.

SafeLine WAF delivered the best results for both high detection and minimal false positives, achieving a 74.09% detection rate, with only 8.19% false positives, a 99.44% accuracy rate, and quick response times under 1 millisecond for most requests. Coraza and ModSecurity detected a similar proportion of attacks, but their very high false positive rates (92.77% and 94.86%, respectively) made them impractical for many production environments. Simpler solutions like Baota, nginx-lua-waf, and SuperWAF demonstrated high speed and low system overhead, but failed to accurately detect most attacks, flagging only around 24–39% of threats. Across all results, the author emphasizes that these findings represent a single test with particular configurations, and users should independently verify WAF behavior in their own environments before final deployment.