In addition to the points discussed.. If you follow the Geekflare link to modsecurity, and then follow the link there to a download page, there's this warning:

In addition to the points discussed.. If you follow the Geekflare link to modsecurity, and then follow the link there to a download page, there's this warning: >NOTE: Some instabilities in the Nginx add-on have been reported (see the Github issues page for details). Please use the "nginx_refactoring" branch where possible for the most up to date version and stay tuned for the ModSecurity version 4. That's not something I would suggest throwing in production, given that warning has been there for years. The post itself describes Shadow daemon as "probably defunct". Ironbee's last commit was two years ago and I get an nxdomain looking for their website. AWS WAF is both expensive and and extremely manual. You won't get anything out of it without a major labour investment. Nginx's built in WAF is only in the pro edition, and outside the price of many people. This whole discussion however depends on your customer. I have an agency I support where I have to provide a report on every single hack attempt. That means if my Rails application gets hit with said three year old Wordpress exploit, and the web server "404", I have to report on how we "blocked" it. And no, "not applicable" is not an answer. So we throw money at commercial products. And sometimes I recommend doing so. But like security can involve just being aware of your risks, this use of a WAF is about being aware of the real problem you're solving, which is a paper work based one.