Neura Market
nbs-system/naxsi logo

nbs-system/naxsi

Free

NAXSI is an open-source, high performance, low rules maintenance WAF for NGINX

FreeFree tier
Type
Open Source
Company
nbs-system
Visit Website GitHub (38 stars)

About nbs-system/naxsi

NAXSI (Nginx Anti XSS SQL Injection) is an open-source, high-performance Web Application Firewall (WAF) module for Nginx. It employs a negative security model, meaning it blocks all requests by default and only allows those explicitly whitelisted. The module uses a small set of simple, readable rules that cover 99% of common web attack patterns (such as XSS and SQL injection), making it resistant to unknown attack variants that might bypass signature-based WAFs. NAXSI supports an auto-learning phase that automatically generates whitelisting rules based on normal site behavior, reducing manual configuration effort. It is compatible with most Nginx versions and runs on platforms like Debian, Ubuntu, CentOS, FreeBSD, and OpenBSD. The project is licensed under GPL-3.0 and was originally developed by nbs-system. As of November 2023, the original repository has been archived; active development continues in a fork maintained by wargio.

Key Features

Negative security model: blocks all requests by default, requires explicit whitelisting for legitimate traffic
Small, readable rule set covering 99% of known web attack patterns (XSS, SQL injection, etc.)
Auto-learning phase that generates whitelisting rules based on observed normal behavior
Third-party Nginx module with high performance and low overhead
No signature database, immune to unknown attack variants
Supports regex via libpcre for advanced matching
Compatible with multiple UNIX-like platforms (Debian, Ubuntu, CentOS, FreeBSD, OpenBSD, NetBSD)
Free and open source under GPL-3.0 license

Pros & Cons

Pros
  • Free and open source (GPL-3.0) with no licensing costs
  • High performance, designed as a native Nginx module
  • Negative model provides strong protection against both known and novel attack patterns
  • Auto-learning reduces manual whitelist creation effort
  • Small, readable rules are easy to understand and customize
  • Wide platform compatibility
Cons
  • Project original repository is archived (no further updates); active development moved to a fork
  • Requires careful whitelisting to avoid blocking legitimate traffic, which can be time-consuming without auto-learning
  • Learning curve for administrators unfamiliar with negative security models
  • Only works with Nginx web server
  • Limited community support for the archived version

Best For

Protecting Nginx web servers from SQL injection and XSS attacksSecuring web applications with a drop-by-default firewall approachAutomated whitelist generation for easier WAF managementDeploying a lightweight, high-performance WAF in environments where signature-based solutions are unsuitable

FAQ

What does NAXSI stand for?
NAXSI stands for Nginx Anti XSS SQL Injection.
Is Naxsi still actively maintained?
The original repository (nbs-system/naxsi) was archived on November 8, 2023, and is no longer updated. Active development continues in a new repository at https://github.com/wargio/naxsi.
How does Naxsi differ from other WAFs?
Unlike most WAFs that rely on a signature database (like antivirus software), Naxsi uses a negative security model with a small set of patterns that block known attack patterns by default. This makes it resistant to unknown attack variants that could bypass signature-based systems.
What platforms does Naxsi support?
Naxsi is compatible with any Nginx version and depends on libpcre. It has been reported to work on NetBSD, FreeBSD, OpenBSD, Debian, Ubuntu, and CentOS.
What license is Naxsi released under?
Naxsi is licensed under the GPL-3.0 license.