Best WAF for HAProxy
Add a web application firewall to HAProxy. Compare the native HAProxy Enterprise WAF against out-of-process SPOA options (coraza-spoa, ModSecurity SPOA) and CrowdSec for load balancer and reverse proxy security.
HAProxy is the world's most widely used open source software load balancer and application delivery controller, sitting in front of high-traffic sites and APIs at companies like Reddit, GitHub, and Roblox. Because it terminates client traffic before it reaches your application servers, HAProxy is a natural place to enforce web application firewall policy.
There is one thing to understand up front: open source HAProxy (HAProxy Community) has no native WAF module. Out of the box it gives you ACL-based request filtering and rate limiting through stick-tables, which handle Layer 3/4 abuse and basic Layer 7 throttling, but it does not inspect request payloads for SQL injection, XSS, or other application-layer attacks. To get true WAF coverage you either add an open source WAF engine out-of-process through HAProxy's Stream Processing Offload Agent (SPOA) mechanism, or you run HAProxy Enterprise, which ships a built-in WAF.
This guide compares the realistic options for putting a WAF in front of, or inside, HAProxy: the native HAProxy Enterprise WAF, open source engines connected over SPOA such as coraza-spoa (which runs the OWASP Core Rule Set) and a ModSecurity SPOA, and CrowdSec for crowd-sourced blocking. It also covers what HAProxy can and cannot do natively, so you can decide where the WAF belongs in your stack.
Top WAF Providers for HAProxy
HAProxy Enterprise WAF
Native Enterprise WAFHAProxy Enterprise WAF is the only WAF that runs natively inside HAProxy itself. It uses a multi-engine architecture: the machine-learning Intelligent WAF Engine detects attacks without regex signatures, and an optional OWASP CRS compatibility mode runs actual OWASP Core Rule Set rules in a separate rule-based engine alongside it. Both execute in the same process as the load balancer, so the WAF adds sub-millisecond latency and negligible CPU overhead. HAProxy reports roughly 99.65% balanced accuracy (99.45% true-positive, 99.81% true-negative) with under 1ms of added latency. It is the natural choice for teams already standardized on HAProxy that can justify a commercial license.
Key Benefits:
- Built into HAProxy Enterprise, no extra proxy hop or SPOA agent
- ML Intelligent WAF Engine, roughly 99.65% balanced accuracy
- In-process design adds sub-millisecond latency
- Optional OWASP CRS compatibility mode (separate rule-based engine)
Coraza Web Application Firewall
Best Open SourceCoraza is the best open source path to a WAF on HAProxy Community. It connects through coraza-spoa, which speaks HAProxy's SPOA protocol, and runs the OWASP Core Rule Set plus any ModSecurity-compatible SecLang rules. Written in Go with no C dependencies, it is easy to deploy as a companion process or container. Note that the coraza-spoa integration is comparatively young and still maturing (the SPOE plugin has historically been described as experimental), so validate it under your traffic before relying on it in production.
Key Benefits:
- Free and open source (OWASP project, Apache 2.0)
- Runs the OWASP CRS and ModSecurity SecLang rules
- Connects to HAProxy over the SPOA/SPOP protocol
- Pure Go, easy to containerize with no C dependencies
ModSecurity Open Source WAF
Industry Standard RulesModSecurity has no official HAProxy connector, but HAProxy ships an example ModSecurity SPOA agent that wraps a standalone ModSecurity v2 build (for example 2.9.x) and runs the OWASP CRS out-of-process. Note that this example agent wraps ModSecurity v2, not libmodsecurity (v3); a v3/libmodsecurity HAProxy SPOA exists only as experimental, unofficial community projects. It is a solid option if your team already maintains SecLang rules and wants the mature, long-established ModSecurity and OWASP CRS ecosystem. The trade-off is that the SPOA agent is a reference/example implementation rather than a polished product, so expect more hands-on setup and maintenance than a first-class module.
Key Benefits:
- Battle-tested SecLang and OWASP CRS rule ecosystem
- Runs out-of-process via a ModSecurity SPOA agent
- Free and open source, no licensing cost
- Familiar to teams migrating existing ModSecurity rules
CrowdSec Web Application Firewall
Crowd-Sourced IntelligenceCrowdSec adds a different layer to HAProxy: crowd-sourced threat intelligence. Its AppSec component provides ModSecurity SecLang-compatible WAF rules, while a HAProxy bouncer enforces blocklists built from signals shared across a large global community of installations. It works well alongside a rules-based WAF rather than replacing one, blocking known-bad IPs at the edge before they reach your application. A free community tier covers core functionality.
Key Benefits:
- HAProxy bouncer plus AppSec WAF component
- Community blocklists from a large global user base
- Compatible with ModSecurity SecLang rules
- Free community tier available
What to Look For in a WAF for HAProxy
When choosing how to add a WAF to HAProxy, weigh these factors:
- In-process vs out-of-process - The HAProxy Enterprise WAF runs inside HAProxy, adding no network hop. Open source options (coraza-spoa, ModSecurity SPOA) run as separate agents that HAProxy communicates with over the SPOA/SPOP protocol. Out-of-process agents are free and flexible but add an inter-process round trip per inspected request.
- OWASP Core Rule Set support - coraza-spoa and the ModSecurity SPOA both run the OWASP CRS and SecLang rules directly. HAProxy Enterprise offers a CRS compatibility mode that runs actual OWASP CRS rules in a separate rule-based engine alongside its ML Intelligent WAF Engine (a multi-engine design), not by feeding rules through the ML model. Confirm the CRS version and how rule updates are delivered.
- SPOA maturity and support - The SPOA ecosystem is smaller than NGINX's WAF module ecosystem. coraza-spoa is relatively new, and the ModSecurity SPOA is an example agent. If you need vendor support and SLAs, HAProxy Enterprise or a commercial option is the safer path.
- Latency and throughput - HAProxy is chosen for performance. An in-process WAF preserves that; a SPOA agent adds latency proportional to inspection cost and agent scaling. Benchmark with your real traffic and size the agent pool accordingly.
- Native rate limiting and ACLs - HAProxy already does a lot before any WAF: stick-tables provide connection and request rate limiting, and ACLs filter on headers, paths, and IPs. Decide what to solve natively versus what genuinely needs payload inspection.
- Real client IP - If HAProxy sits behind a CDN or another proxy, configure X-Forwarded-For or the PROXY protocol so the WAF and your rate limits see the true client address, not the upstream proxy's.
HAProxy Considerations
HAProxy-specific considerations when deploying a WAF:
- Community has no WAF module - Open source HAProxy provides ACL filtering and stick-table rate limiting only. Application-layer WAF requires either a SPOA agent or an upgrade to HAProxy Enterprise. Do not assume HAProxy Community includes signature or ML-based threat detection; it does not.
- How SPOA/SPOE works - HAProxy uses a Stream Processing Offload Engine (SPOE) filter to forward request data over the SPOP protocol to a Stream Processing Offload Agent (SPOA). The agent inspects the request and returns a verdict (allow, deny, tag) that HAProxy acts on. coraza-spoa and the ModSecurity SPOA are both SPOA agents.
- Request body inspection has limits - For a SPOA WAF to inspect
request payloads, HAProxy must buffer the body first with
option http-buffer-requestin the frontend; without it the agent receives no request body. Buffered body size is capped bytune.bufsize(default 16 KB, practically around 64 KB), a hard HAProxy limit separate from the WAF engine's own SecRequestBodyLimit, so very large bodies can be truncated before the WAF sees them. Raisingtune.bufsizecosts memory on every connection, so size it deliberately rather than matching a multi-megabyte body limit. - coraza-spoa status - The coraza-spoa integration runs the
OWASP CRS through the Coraza engine and is the most active open source route,
but it is still maturing and has historically been labeled experimental. Pin
versions and test rule updates before rolling to production, and remember Coraza
only blocks when the ruleset sets
SecRuleEngine On(the DetectionOnly default logs without blocking). - ModSecurity SPOA is an example agent - There is no official ModSecurity HAProxy module. HAProxy ships a contrib/example SPOA that wraps a standalone ModSecurity v2 build out-of-process. It works, but expect to build and maintain it yourself rather than install a supported package.
- Rate limiting stays native - Even with a WAF in place, keep abuse controls in stick-tables and ACLs where they belong. They run in-process at line rate and reduce the volume of traffic your WAF agents need to inspect.
- Deployment shape - HAProxy Enterprise WAF ships across on-premises, cloud, Kubernetes, the ALOHA appliance, and the fully managed HAProxy Edge service, using the same engine. Open source SPOA agents run wherever you run HAProxy, typically as a companion process or sidecar container.
Frequently Asked Questions
Does open source HAProxy include a WAF?
No. Open source HAProxy (HAProxy Community) is a load balancer and reverse proxy. It provides ACL-based request filtering and rate limiting through stick-tables, but it does not inspect payloads for application-layer attacks like SQL injection or XSS. To add a real WAF you either connect an open source engine over SPOA (coraza-spoa or a ModSecurity SPOA) or run HAProxy Enterprise, which has a built-in WAF.
How do I add a WAF to HAProxy?
Two main approaches. First, out-of-process open source: run a Stream Processing Offload Agent (SPOA) alongside HAProxy. coraza-spoa runs the OWASP Core Rule Set through the Coraza engine, and a ModSecurity SPOA runs a standalone ModSecurity v2 build with CRS. HAProxy forwards requests to the agent over the SPOP protocol and acts on its verdict. Second, native: upgrade to HAProxy Enterprise, whose Intelligent WAF Engine runs in-process with no separate agent.
What is SPOA, SPOE, and SPOP?
They are the pieces of HAProxy's offload mechanism for pushing work to an external agent. SPOE (Stream Processing Offload Engine) is the HAProxy-side filter you configure; SPOP (Stream Processing Offload Protocol) is the wire protocol; SPOA (Stream Processing Offload Agent) is the external program that does the work, such as a WAF. coraza-spoa and the ModSecurity SPOA are both SPOA agents that inspect requests and return an allow or deny decision.
Should I use coraza-spoa or a ModSecurity SPOA?
Both run the OWASP CRS and ModSecurity-compatible SecLang rules over SPOA. coraza-spoa is built on Coraza, a modern Go engine with no C dependencies, and is the more actively developed integration, though it is still maturing. The ModSecurity SPOA runs a standalone ModSecurity v2 build (not libmodsecurity v3) but is an example/contrib agent you build and maintain yourself. For new deployments, coraza-spoa is usually the better starting point; choose the ModSecurity SPOA if you have an existing ModSecurity rule investment.
Can I rate limit and block bad traffic in HAProxy without a WAF?
Yes, up to a point. HAProxy's stick-tables track per-client metrics (request rate, connection rate, error rate) and let you throttle or deny abusive sources, while ACLs filter on headers, paths, methods, and IP ranges. This handles Layer 3/4 abuse and basic Layer 7 rate limiting natively and efficiently. What it cannot do is inspect request payloads for injection or XSS attacks, which is where a WAF is required.
HAProxy Enterprise WAF vs an open source SPOA WAF, which should I pick?
HAProxy Enterprise WAF runs in-process with the load balancer, adds sub-millisecond latency, uses an ML engine instead of regex signatures, and comes with commercial support, but it requires a paid license with custom pricing. An open source SPOA (coraza-spoa or ModSecurity SPOA) is free and gives you transparent CRS/SecLang rules you fully control, at the cost of an extra out-of-process hop and self-managed setup and maintenance. Choose Enterprise for latency, accuracy, and support; choose a SPOA when budget and rule transparency matter most.
Does CrowdSec work with HAProxy?
Yes. CrowdSec provides a HAProxy bouncer that enforces blocklists, and its AppSec component adds WAF inspection using ModSecurity SecLang-compatible rules. Its strength is crowd-sourced threat intelligence, blocklists built from signals shared across a large global community of installations, so it works best as a complementary layer that blocks known-bad IPs before they reach a rules-based WAF like coraza-spoa or the HAProxy Enterprise WAF.