There was a point in the article about WAFs being quite slow, in particular the article talks about Nginx with ModSecurity. However, some benchmarks from a whi

There was a point in the article about WAFs being quite slow, in particular the article talks about Nginx with ModSecurity. However, some benchmarks from a while ago suggested that Nginx performs worse with ModSecurity than Apache does in a similar configuration: https://blog.litespeedtech.com/2019/12/02/modsecurity-performance-apache-nginx-litespeed/ https://blog.litespeedtech.com/2019/12/02/modsecurity-perfor... Seems like Coraza also has some more recent benchmarks, since from what I can tell they more or less aim to replace ModSecurity in some regards: https://coraza.io/docs/reference/benchmarks/ https://coraza.io/docs/reference/benchmarks/ I wonder whether anyone has undertaken the effort to compare the performance of the self-hosted WAF options in 2023, or at least in the past few years. Personally, I think the performance tradeoff might sometimes be worth it if security does indeed improve, the Swiss cheese model (defense in depth) and all that: https://en.wikipedia.org/wiki/Swiss_cheese_model https://en.wikipedia.org/wiki/Swiss_cheese_model