awesome-repositories.com
Blog
MCP
awesome-repositories.com

Discover the best open-source repositories with AI-powered search.

ExploreCurated searchesOpen-source alternativesSelf-hosted softwareBlogSitemap
ProjectMCP serverAboutHow we rankPress
LegalPrivacyTerms
© 2026 Bringes Technology SRL·VAT RO45896025·hello@awesome-repositories.com
loveshell avatar

loveshell/ngx_lua_waf

0
View on GitHub↗

Ngx Lua Waf

ngx_lua_waf is an OpenResty web application firewall that uses Lua to filter malicious HTTP requests and block web attacks. It operates as a programmable request filter and IP access controller for Nginx, providing a security layer to identify and block unauthorized scanners, fuzzing attempts, and abnormal network requests.

The project includes capabilities for HTTP layer 7 DDoS mitigation by restricting request frequency per IP address. It further secures the environment by restricting access to sensitive archives and blocking script execution in upload directories to prevent data leakage.

The system manages security through regular expression pattern matching across URLs, headers, cookies, and POST bodies to block threats such as SQL injection and XSS. It provides administrative tools for managing IP white-lists and black-lists, logging security events for auditing, and synchronizing firewall rules from a remote server.

AI search

Explore more awesome repositories

Describe what you need in plain English — the AI ranks thousands of curated open-source projects by relevance.

Start searching with AI

Features

  • NGINX Extensions - Implements security logic as a programmable extension within the Nginx request processing pipeline using Lua.
  • Web Application Firewalls - Implements a web application firewall that protects services from SQL injection and XSS via real-time HTTP traffic inspection.
  • Network Request Filters - Uses regular expression rules to inspect and block common web threats such as SQL injection and XSS.
  • Programmable Request Filters - Provides a programmable Lua-based engine to scan HTTP headers and request bodies for malicious injection patterns.
  • Regex Pattern Matching - Scans request headers and bodies against predefined regular expression rules to identify and block web attacks.
  • Layer 7 Rate Limiters - Mitigates Layer 7 DDoS attacks by restricting the frequency of requests allowed from a single IP address.
  • Access Control Lists - Controls network traffic by permitting or blocking requests based on defined IP white-lists and black-lists.
  • IP Address Filtering - Filters network traffic by comparing client IP addresses against configured white-lists and black-lists.
  • Denial of Service Prevention - Mitigates high-frequency stress testing and coordinated attacks by limiting the request rate per IP address.
  • DoS Attack Defenses - Prevents server resource exhaustion by implementing defenses against flooding and DoS attack patterns.
  • File Upload Security - Scans POST data and uploaded file extensions for malicious patterns to prevent injection and file-upload attacks.
  • Payload Inspection - Analyzes request bodies and uploaded file extensions for malicious patterns to stop injection and file-upload threats.
  • Malicious Traffic Blocking - Filters incoming network traffic to block unauthorized scanners, fuzzing attempts, and other malicious request patterns.
  • Request Body Inspection - Inspects URLs, POST bodies, and cookies for malicious patterns to block abnormal network requests.
  • Scanner Traffic Filtering - Inspects request methods, headers, and cookies to identify and block unauthorized scanners and malicious traffic.
  • Web Attack Blocking - Filters incoming requests for common injection and fuzzing attempts using configurable regular expression rules.
  • IP-Based Rate Limiting - Prevents denial of service attacks by restricting the number of requests allowed per IP address.
  • Traffic Management - Controls traffic based on IP lists and concurrency limits to protect server resources from exhaustion.
  • Remote Rule Synchronization - Updates firewall protection patterns by downloading and synchronizing new configuration files from a remote server.
  • IP Allow/Deny Lists - Manages access to the server by permitting or blocking requests based on defined IP white-lists and black-lists.
  • Path Access Restrictions - Blocks unauthorized access to sensitive archives and prevents script execution in specific directories.
  • Sensitive File Protections - Blocks public web access to sensitive archives and prevents script execution in upload directories to prevent data leakage.
  • Firewall Rule Synchronization - Synchronizes firewall security policies by downloading new rule files from a remote server.
4,025 stars·1,457 forks·Lua·18 views

Star history

Star history chart for loveshell/ngx_lua_wafStar history chart for loveshell/ngx_lua_waf

How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.

Frequently asked questions

What does loveshell/ngx_lua_waf do?

ngxluawaf is an OpenResty web application firewall that uses Lua to filter malicious HTTP requests and block web attacks. It operates as a programmable request filter and IP access controller for Nginx, providing a security layer to identify and block unauthorized scanners, fuzzing attempts, and abnormal network requests.

What are the main features of loveshell/ngx_lua_waf?

The main features of loveshell/ngx_lua_waf are: NGINX Extensions, Web Application Firewalls, Network Request Filters, Programmable Request Filters, Regex Pattern Matching, Layer 7 Rate Limiters, Access Control Lists, IP Address Filtering.

Which projects share features with loveshell/ngx_lua_waf?

Projects with overlapping indexed features include: rack/rack-attack — Rack-attack is a middleware rate limiter and request filter for the Rack interface. It provides a system for… mitchellkrogza/nginx-ultimate-bad-bot-blocker — This project is a collection of configuration files and scripts serving as a bot blocker and security middleware for… microsoft/security-101 — Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular,… protectai/llm-guard — LLM Guard is a security firewall and guardrail framework designed to scan and sanitize inputs and outputs for large… cilium/tetragon — Tetragon is an eBPF-based runtime security and observability toolset designed for Linux and Kubernetes environments.… owasp/cheatsheetseries — The OWASP Cheat Sheet Series is a comprehensive, community-driven repository of concise security best practices and…

Projects sharing features with Ngx Lua Waf

These projects share indexed features with Ngx Lua Waf. Shared tags can include platform or build tooling; verify the primary use case before treating a result as a replacement.
  • rack/rack-attackrack avatar

    rack/rack-attack

    5,746View on GitHub↗

    Rack-attack is a middleware rate limiter and request filter for the Rack interface. It provides a system for throttling HTTP requests and maintaining IP address blocklists to protect applications from malicious traffic and denial-of-service attacks. The project enables application layer DDoS mitigation and API rate limit management by identifying and rejecting requests from banned clients or abusive IP addresses. It allows for the definition of safelists to bypass filters and uses custom logic to determine if a client should be blocked or throttled. The tool covers comprehensive traffic mana

    Rubyrackrack-attackrack-middleware
    View on GitHub↗5,746
  • mitchellkrogza/nginx-ultimate-bad-bot-blockermitchellkrogza avatar

    mitchellkrogza/nginx-ultimate-bad-bot-blocker

    4,750View on GitHub↗

    This project is a collection of configuration files and scripts serving as a bot blocker and security middleware for Nginx. It functions as an automated blocklist manager that filters malicious user-agents and IP addresses to mitigate vulnerability scanning, login brute-forcing, and DDoS attacks. The system distinguishes itself by automating the maintenance of security rules, downloading updated bot definitions and reloading the server on a schedule. It also includes a search engine spam filter capable of generating robots.txt files and link disavow lists to prevent malicious domains from imp

    Shelladwarebot-blockerbots
    View on GitHub↗4,750
  • microsoft/security-101microsoft avatar

    microsoft/Security-101

    6,203View on GitHub↗

    Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field. The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of do

    HTMLappseccia-triaddata-protection
    View on GitHub↗6,203
  • protectai/llm-guardprotectai avatar

    protectai/llm-guard

    2,561View on GitHub↗

    LLM Guard is a security firewall and guardrail framework designed to scan and sanitize inputs and outputs for large language models. It functions as a proxy gateway and security layer to block prompt injections, toxicity, and sensitive data leakage while ensuring that model interactions remain compliant with organizational policies. The system distinguishes itself through a modular scanner pipeline that utilizes local model orchestration to eliminate external network dependencies. It supports real-time security filtering via streaming chunk analysis and implements a fail-fast execution model

    Pythonadversarial-machine-learningchatgptlarge-language-models
    View on GitHub↗2,561
Compare all 30 related projects→