Web Application Firewalls (WAFs) for Self-Hosters (2025): ModSecurity vs. Cloudflare

Exposing web applications (like WordPress, Nextcloud, or custom apps) to the internet makes them targets for various attacks. A Web Application Firewall (WAF) acts as a shield, filtering and monitoring HTTP traffic between a web application and the internet to block malicious requests. This guide explains what is a web application firewall and compares two popular options for self-hosters in 2025: the open-source ModSecurity and the Cloudflare WAF service.

What Does a WAF Protect Against?

WAFs primarily aim to mitigate risks outlined in the OWASP Top 10, including:

Injection Attacks: SQL injection, NoSQL injection, command injection, etc.
Cross-Site Scripting (XSS): Injecting malicious scripts into websites viewed by other users.
Broken Authentication & Session Management: Hijacking user sessions or bypassing login controls.
Security Misconfiguration: Exploiting insecure default settings or configurations.
XML External Entities (XXE): Exploiting XML parsers.
Cross-Site Request Forgery (CSRF): Tricking users into submitting malicious requests.
Using Components with Known Vulnerabilities: Blocking requests targeting known vulnerable libraries.

Option 1: ModSecurity (Self-Hosted WAF)

ModSecurity is a widely used, open-source WAF engine that can be integrated with web servers like Nginx and Apache. It works by inspecting requests and responses against a set of rules.

Core Rule Set (CRS): The OWASP ModSecurity Core Rule Set is a free, community-maintained set of generic attack detection rules that provides baseline protection against many common web application attacks.

Pros:

Open Source & Free: No licensing costs for the engine or the OWASP CRS.
Full Control & Customization: You control the rules, sensitivity, and logging.
Self-Hosted: Traffic doesn’t necessarily need to leave your network (unless already using an external proxy).
Flexibility: Can be deployed directly on the web server, as part of a reverse proxy (like Nginx Proxy Manager with modifications), or on a dedicated appliance.

Cons:

Complexity: Requires significant configuration and tuning. False positives (blocking legitimate traffic) are common initially and require careful rule adjustments.
Performance Overhead: Rule processing consumes CPU and memory resources on the host system.
Maintenance: Requires ongoing effort to update the engine, ruleset (OWASP CRS), and manage exclusions for false positives.
No Built-in DDoS Protection: Primarily focuses on Layer 7 (application) attacks, not volumetric DDoS attacks.

Setup (Conceptual Nginx Example):

Install ModSecurity Module: Compile Nginx with ModSecurity support or install pre-built packages (e.g., nginx-extras on Debian/Ubuntu often includes it).
Install OWASP CRS: Download the latest Core Rule Set from GitHub.
Configure ModSecurity: Edit modsecurity.conf to enable the engine (SecRuleEngine On) and point to the CRS files.
Configure Nginx: Enable ModSecurity in your Nginx server block (modsecurity on;, modsecurity_rules_file /path/to/modsecurity.conf;).
Tune Rules: Monitor logs (/var/log/nginx/error.log, /var/log/modsec_audit.log) for blocked requests. Identify false positives and create rule exclusions (e.g., using SecRuleUpdateTargetById).

This ModSecurity tutorial nginx setup requires technical expertise. Using a WAF for docker often involves running ModSecurity within the reverse proxy container or a dedicated sidecar container.

Option 2: Cloudflare WAF (Cloud-Based Service)

Cloudflare is a widely used CDN, DNS, and security service. Their WAF runs on their global edge network, filtering traffic before it reaches your origin server.

Pros:

Ease of Use: Simple toggle-based setup via the Cloudflare dashboard.
Managed Rulesets: Cloudflare manages and updates rulesets (including OWASP Top 10 mitigation and specific rules for platforms like WordPress) automatically.
Performance: Filtering happens at the edge, potentially improving site speed (due to CDN) and reducing load on your origin server.
Integrated DDoS Protection: Cloudflare provides robust protection against volumetric DDoS attacks (even on the free plan).
Free Tier: Offers basic WAF capabilities (OWASP ruleset, configurable sensitivity) suitable for many personal sites and small applications.

Cons:

Third-Party Dependency: Relies entirely on Cloudflare’s infrastructure.
Less Granular Control (Free Tier): Limited ability to customize individual rules or create complex custom rules on the free plan.
Data Privacy: Your traffic flows through Cloudflare’s network (though they have privacy policies).
Cost: Advanced features (custom rules, rate limiting, bot management) require paid plans.

Setup (Conceptual):

Sign up for Cloudflare: Add your domain to Cloudflare.
Change Nameservers: Point your domain’s nameservers to Cloudflare’s.
Enable Proxy (Orange Cloud): Ensure DNS records for your web application are proxied through Cloudflare.
Navigate to Security -> WAF:
- Review Managed Rules. Enable the “Cloudflare Managed Ruleset” (includes OWASP).
- Adjust sensitivity levels (Low, Medium, High) if needed.
- Consider enabling specific rulesets (e.g., WordPress) if applicable.
Monitor: Check the Security Overview and Events log for blocked traffic and adjust settings if legitimate requests are blocked.

The Cloudflare WAF setup guide is significantly simpler than configuring ModSecurity from scratch.

ModSecurity vs. Cloudflare WAF Comparison

Feature	ModSecurity + OWASP CRS	Cloudflare WAF (Free Tier)	Cloudflare WAF (Paid Tiers)
Cost	Free (Software)	Free	Paid (Pro, Business, Enterprise)
Setup Complexity	High	Low	Low
Maintenance	High (Updates, Tuning)	Low (Managed Rules)	Low (Managed Rules)
Customization	Very High	Low (Sensitivity, some toggles)	High (Custom Rules, Rate Limiting)
Performance Impact	On Origin Server	Minimal/Positive (Edge Filtering)	Minimal/Positive (Edge Filtering)
DDoS Protection	No (Application Layer Only)	Yes (Volumetric)	Yes (Advanced)
Control	Full	Limited	Moderate-High
Infrastructure	Self-Hosted	Cloudflare Edge	Cloudflare Edge

Which WAF Should You Choose?

Choose ModSecurity if:
- You need absolute control over rules and configuration.
- You cannot or prefer not to route traffic through a third party.
- You have the technical expertise and time for setup and ongoing maintenance.
- You are already using a reverse proxy like Nginx and want integrated protection.
Choose Cloudflare WAF (Free Tier) if:
- You want a simple, effective baseline WAF with minimal effort.
- You also benefit from Cloudflare’s CDN and DDoS protection.
- You run common applications (like WordPress) covered by their managed rules.
- You are comfortable routing traffic through Cloudflare.
Choose Cloudflare WAF (Paid Tier) if:
- You need more advanced features like custom rules, rate limiting, or advanced bot management.
- You require higher levels of support or SLAs.

For many self-hosters, starting with the Cloudflare WAF free tier is often the easiest and most practical way to get significant OWASP Top 10 protection and DDoS mitigation. If you hit limitations or require more control, exploring ModSecurity or Cloudflare’s paid plans are the next steps.

Securing Self-Hosted Services Learn about other essential security layers like reverse proxies and Fail2Ban.

Conclusion

A WAF is a valuable layer in securing your web applications. While ModSecurity offers unparalleled control for those willing to invest the time in configuration and maintenance, Cloudflare WAF provides an accessible and powerful alternative, especially with its integrated DDoS protection and ease of use, making it a compelling choice for many self-hosters looking to protect self-hosted apps effectively.