An open-source, high-performance Web Application Firewall (WAF) module for NGINX that blocks malicious web traffic by default.
NAXSI is an open-source Web Application Firewall (WAF) module for NGINX that protects web applications from common attacks like SQL injection and cross-site scripting (XSS). It operates on a default-deny principle, blocking all traffic unless explicitly whitelisted, and uses a minimal set of rules to detect malicious patterns. The project solves the need for a high-performance, low-maintenance WAF that doesn't rely on signature databases.
System administrators, DevOps engineers, and security professionals managing NGINX web servers who need a lightweight, effective WAF to secure web applications against common vulnerabilities.
Developers choose NAXSI for its simplicity, performance, and security-by-default approach, which avoids the pitfalls of signature-based WAFs and reduces rule maintenance. Its open-source nature and compatibility with various UNIX-like platforms make it a flexible and cost-effective alternative to commercial WAF solutions.
NAXSI is an open-source, high performance, low rules maintenance WAF for NGINX
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Blocks all web traffic by default unless explicitly whitelisted, following a DROP-by-default firewall philosophy that effectively prevents unknown attack vectors like zero-day exploits.
Uses a small, readable set of rules in naxsi_core.rules that cover 99% of known vulnerability patterns, reducing the need for frequent signature updates compared to traditional WAFs.
Includes an intensive auto-learning phase that can automatically generate whitelisting rules based on observed website behavior, simplifying initial setup for legitimate traffic.
Designed as a lightweight third-party NGINX module, it ensures minimal impact on server performance, making it suitable for resource-constrained environments or high-traffic sites.
The original repository is archived with no new updates or bug fixes, requiring users to switch to the new repository at https://github.com/wargio/naxsi for continued support, which adds migration overhead.
Operates on a default-deny model, necessitating extensive manual whitelisting of legitimate traffic patterns through log analysis, which can be time-consuming and error-prone for complex applications.
Only compatible with NGINX web servers, limiting its use in environments with Apache, IIS, or serverless architectures, and requiring NGINX expertise for deployment.
The simple rule set can block legitimate queries (e.g., containing characters like '<' or 'drop'), forcing constant monitoring during the auto-learning phase to avoid disrupting normal traffic.