NAXSI

The original NAXSI repository by NBS System was officially archived in November 2023. However, development continues actively in a fork maintained by Giovanni Dante Grazioli (wargio), who was the last active developer on the original project. The fork receives regular updates, bug fixes, and maintains compatibility with current NGINX versions.

That said, the project has a single primary maintainer, which is a bus factor risk worth considering for production deployments. If long-term maintenance certainty is important to you, ModSecurity or Coraza have larger contributor communities.

NAXSI and ModSecurity take fundamentally different approaches to WAF protection. NAXSI uses a scoring-based model with a small set of generic rules that flag suspicious patterns (SQL keywords, angle brackets, pipe characters) and blocks requests when the cumulative score exceeds a threshold. ModSecurity uses the SecRule language, which allows highly specific pattern matching, and benefits from the OWASP Core Rule Set (CRS) with thousands of curated rules.

In practice, NAXSI is lighter and faster to get running. You deploy it, enable learning mode, generate whitelists, and you are protected. ModSecurity requires more expertise to configure but gives you far more granular control. For most production environments, ModSecurity with CRS is the safer long-term choice. NAXSI shines when you want minimal overhead and a simple deny-by-default model. See the full ModSecurity vs NAXSI comparison.

Coraza is a modern, Go-based WAF engine that is fully compatible with the OWASP Core Rule Set. It supports NGINX (via Coraza NGINX module), Envoy, Traefik, and can run as a standalone proxy. NAXSI is a C module exclusively for NGINX with its own rule format.

If you need CRS compatibility, multi-platform support, or a more actively maintained ecosystem, Coraza is the stronger choice. If you want the lightest possible NGINX module with minimal dependencies and a simple scoring model, NAXSI still has a place. See the full Coraza vs NAXSI comparison.

No. NAXSI is built specifically as an NGINX module and cannot run on any other web server. If you need WAF protection for Apache, your main options are ModSecurity (the original Apache WAF module) or a cloud-based WAF like Cloudflare that sits in front of your server regardless of what it runs.

For environments running multiple web servers or planning to migrate away from NGINX, Coraza offers broader platform support while maintaining compatibility with standard WAF rule sets. For a full overview of NGINX-compatible options, see our Best WAF for NGINX guide.

No. NAXSI uses its own rule format and scoring system, which is completely incompatible with the OWASP CRS. It ships with a default set of core rules (often called naxsi_core.rules) that cover common attack patterns like XSS, SQL injection, and file inclusion by assigning scores to suspicious characters and keywords.

This is a fundamental architectural difference. CRS-compatible WAFs like ModSecurity and Coraza benefit from a community-maintained rule set with thousands of rules covering specific CVEs, evasion techniques, and application-level attacks. NAXSI trades that breadth for simplicity: fewer rules, less maintenance, but also less coverage of edge cases.

Yes, NAXSI works with WordPress since it operates at the NGINX level, inspecting all HTTP requests before they reach PHP. However, WordPress generates complex request patterns (admin-ajax.php, REST API, block editor, plugin-specific queries) that will trigger false positives with NAXSI's deny-by-default approach. You will need to invest time in learning mode and whitelist tuning to avoid blocking legitimate WordPress functionality.

If your primary goal is WordPress protection, dedicated WordPress WAF plugins like Wordfence or NinjaFirewall are purpose-built for WordPress and require far less tuning. See our Best WAF for WordPress guide for a full comparison.