Repolode
Submit
fabriziosalmi

fabriziosalmi/caddy-waf

A Web Application Firewall middleware for the Caddy web server, with regex rules, IP/DNS/ASN/GeoIP filtering, rate limiting and Tor exit-node blocking.

Open-source alternative to:Cloudflare WAF

View on GitHubWebsite
Stars
876
Forks
37
Open issues
1
Last commit
3 days ago

What is it?

caddy-waf is an HTTP handler module for Caddy, written in Go, that inspects requests and responses against a regular-expression rule set. Rules carry scores, and a request is blocked once its total reaches a configurable anomaly threshold. Inspection covers four phases: request headers, request body, response headers and response body.

Beyond rule matching, it enforces IP and CIDR blacklists, DNS blacklists, MaxMind GeoLite2 country and ASN blocking, and a periodically refreshed Tor exit-node list. It also provides per-IP sliding-window rate limiting with optional path matching, custom block responses, and a JSON metrics endpoint. Rule and blacklist files are watched for changes and reloaded without restarting.

The module is configured through the Caddyfile or JSON and can be built with xcaddy, installed via caddy add-package, or run from a Docker image. It is licensed under AGPL-3.0.

Key features

  • 01Regex rule engine built on Go's RE2 package with per-rule anomaly scoring.
  • 02Inspection of request and response headers and bodies across four phases.
  • 03IP and CIDR blacklists, plus DNS blacklists.
  • 04GeoIP country and ASN blocking using MaxMind GeoLite2 databases.
  • 05Per-IP sliding-window rate limiting with optional path patterns.
  • 06Tor exit-node blocking and hot reload of rule and blacklist files.

Use cases

  • Protecting a site served by Caddy from common web attacks using a rule set.
  • Blocking traffic from specific countries, ASNs, IP ranges or Tor exit nodes.
  • Rate limiting API endpoints on a Caddy reverse proxy.
  • Exporting WAF metrics to Prometheus or Grafana dashboards.

Quick start

  1. 1

    Install the module with xcaddy

    go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest
  2. 2

    Build Caddy with the caddy-waf module

    xcaddy build --with github.com/fabriziosalmi/caddy-waf
  3. 3

    Verify the WAF module is available

    ./caddy list-modules | grep waf

Things to know

  • Licensed under AGPL-3.0, a copyleft license that may not suit every deployment.
  • Requires Go 1.26.0 or newer and Caddy v2.11.x or newer.
  • Optional GeoIP features need a MaxMind GeoLite2 database file.

Topics

#waf#caddy#security#rate-limiting#geoip#web-security#reverse-proxy#caddy-module#caddy-plugin#caddy-security

FAQ

What is caddy-waf?
A Web Application Firewall middleware for the Caddy web server, with regex rules, IP/DNS/ASN/GeoIP filtering, rate limiting and Tor exit-node blocking. caddy-waf is an HTTP handler module for Caddy, written in Go, that inspects requests and responses against a regular-expression rule set. Rules carry scores, and a request is blocked once its total reaches a configurable anomaly threshold. Inspection covers four phases: request headers, request body, response headers and response body.
Is caddy-waf free to use? What license does it have?
caddy-waf is open source under the AGPL-3.0 license. Check the license terms before using it in commercial products.
Is caddy-waf still maintained?
Actively maintained. The last commit to caddy-waf was on Oct 17, 2026.
What can I use caddy-waf for?
Protecting a site served by Caddy from common web attacks using a rule set. Blocking traffic from specific countries, ASNs, IP ranges or Tor exit nodes. Rate limiting API endpoints on a Caddy reverse proxy. Exporting WAF metrics to Prometheus or Grafana dashboards.
How do I install caddy-waf?
Install the module with xcaddy: go install github.com/caddyserver/xcaddy/cmd/xcaddy@latest Build Caddy with the caddy-waf module: xcaddy build --with github.com/fabriziosalmi/caddy-waf Verify the WAF module is available: ./caddy list-modules | grep waf
Where can I get caddy-waf?
The source code and installation instructions are on GitHub: https://github.com/fabriziosalmi/caddy-waf

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects