# Discourse + Web Application Firewall (WAF) mod\_security

**URL:** <https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612>\
**Category:** Self-hosting\
**Tags:** unsupported-install, hosting\
**Created:** [November 17, 2019, 1:37pm UTC](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612 "2019-11-17T13:37:55Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![maltfield](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/maltfield/32/160669_2.png) [@maltfield](https://meta.discourse.org/u/maltfield)\
**Post date:** [November 17, 2019, 1:37pm UTC](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612/1 "2019-11-17T13:37:55Z")

</div>

What is the recommended WAF to run in-front of Discourse?

I recently succeeded in modifying the nginx config installed in the Discourse docker container to include ModSecurity and the OWASP (Open Web Application Security Project) CRS (Core Rule Set).

- [https://www.modsecurity.org/crs/](https://www.modsecurity.org/crs/)

So far my tests are great, and ModSecurity appears to play very well with Discourse ootb.

What are other users’ experiences with WAFs & Discourse? Do you have any recommendations other than ModSecurity?

---

_[View the full topic](https://meta.discourse.org/t/discourse-web-application-firewall-waf-mod-security/133612)._