Enterprise Web Security Out of the Box

FOXWAF is an open-source Go WAF (Web Application Firewall) with a built-in Go reverse proxy — a lightweight drop-in alternative to Nginx + ModSecurity. It blocks OWASP Top 10 attacks (SQL injection, XSS, RCE, file inclusion, SSRF) and provides CC/DDoS protection, ShangMi (SM2/SM3/SM4) cryptography, HTTP/3 (QUIC), and full hot-reload of configuration, rules and certificates.

FOXWAF is a single-process solution that combines a reverse proxy and a WAF engine in one Go binary, replacing the traditional Nginx + ModSecurity two-tier stack. Rule matching uses an Aho-Corasick automaton instead of ModSecurity's sequential regex evaluation, delivering several times the throughput. Configuration, rules and certificates are all hot-reloaded via the Web console or API with no Nginx reload required. HTTP/3 (QUIC) and ShangMi (SM2/SM3/SM4) cryptography are supported natively without recompiling third-party modules.

The Personal edition is free and includes the WAF rule engine, reverse proxy, SSL management and Docker deployment, suitable for individual developers and small projects. The Pro edition adds CC/DDoS protection, advanced site features, plugin system, custom rules, ShangMi (SM) cryptography, and HTTP/3 (QUIC), suitable for enterprise-grade production environments.

Yes. FOXWAF officially recommends a one-click installation script that deploys via Docker Compose, ready in 5 minutes. Linux amd64 / arm64 with Docker >= 20.10 is required.

On the Pro edition, upload an SM2 certificate and its private key under Site configuration; FOXWAF automatically negotiates SM-TLS and enables SM3 hashing and SM4 symmetric encryption for capable clients. The Personal edition supports only ECDSA / RSA. SM2 certificates may coexist with conventional RSA / ECDSA certificates on the same site, and the appropriate one is selected automatically based on client capability.

The Pro edition supports HTTP/3 over QUIC natively. After enabling HTTP/3 in Site configuration, FOXWAF listens on UDP at the same port and advertises the upgrade via the Alt-Svc response header. A host kernel >= 5.4 is recommended for optimal UDP socket performance.

Yes. FOXWAF's built-in reverse proxy natively supports HTTP/1.1 Upgrade to WebSocket as well as HTTP/2 and gRPC bidirectional streams. No special configuration is required: when the proxy detects an Upgrade: websocket header or a Content-Type: application/grpc, it automatically switches to streaming forwarding without buffering the full request body.

No. All FOXWAF configuration (sites, upstreams, certificates, rule sets, mirror sources, CC/Bot thresholds) takes effect immediately on save through the console or API. The runtime uses RCU-style double-buffer switching: new requests use the new configuration while in-flight requests continue with the old configuration to completion, ensuring zero downtime. Rule tries are rebuilt and swapped atomically, and certificate / SNI routing tables are replaced as read-only maps.

Run foxwaf update. The CLI tries the configured mirrors (GitHub / GitCode / official direct link) in priority order, downloads the latest release, verifies the MD5 checksum, swaps the image and restarts the Docker container. The Web console's Version Management page also lets you upgrade to or roll back to a specific version manually; the current configuration and database are automatically backed up to the backup/ directory before each upgrade.

FOXWAF publishes releases on both GitHub and GitCode. The core protection engine and rulesets are closed-source, while the CLI tooling and documentation are open. Pro features are activated via RSA-signed licenses.