Your traffic.
Your rules.
Your guardian.
The open-source web application firewall that puts you in control. Pure Go. Zero dependencies. All the protection, none of the baggage.
External Go dependencies
Everything you need. Nothing extra.
Attack detectors
Layered defense, from SQLi to SSRF.
Ways to deploy
Proxy, middleware, or sidecar.
p99 overhead target
Built to stay out of the way.
Everything a guardian needs.
Nothing to hold you back.
Security should simplify your stack.
One Go binary brings your defenses together,
from the first request to the final response.
Understands the attack.
Protects the application.
Tokenizer-based inspection and configurable threat scoring. Eleven purpose-built detectors working as one.
id = 1 OR 1=1 --
Real people in.
Bad bots out.
TLS fingerprinting, behavioral signals, and JavaScript proof-of-work challenges.
One front door.
Your whole stack.
Multi-domain routing, load balancing, automatic TLS, and circuit breakers. Built right in.
Your tools. Supercharged.
Optional AI threat analysis and 44 MCP tools. Connect your guardian to the way you work.
Trust the code.
Because you can read it.
Pure Go. MIT licensed. Audit it, adapt it,
make it yours.
Good traffic gets through.
The rest meets its guardian.
Six layers of inspection. One seamless pipeline.
Pick an example and follow the request.
GET /api/products?category=books_200No suspicious tokens. The request reaches your application.
Example score 0/100Illustrative requests and scores. Actual verdicts depend on your configuration; this demo does not run the WAF.
Your first line of defense.
Just a few lines away.
Run it on its own. Drop it into Go.
Ship it alongside your containers.
One container. Every backend.
Put GuardianWAF in front of your app. The sidecar inspects incoming traffic and forwards clean requests to your upstream.
Read the setup guideHowever you choose to deploy.
docker run -d --name guardianwaf \
-p 8088:8088 \
ghcr.io/guardianwaf/guardianwaf:latest \
sidecar --upstream http://app:3000Clarity.
Built in.
Understand your traffic without assembling another stack. Your dashboard, events, upstream health, and configuration live in one place.
- Live requests and security events
- Upstream health and circuit breakers
- Configuration changes without restarts
- Prometheus-ready metrics
/ Overview Example dataTraffic overview
Last 24 hoursSQL injectionGET /api/usersJust nowBot detectionGET /checkout2s ago01Does my application have to be written in Go?+
No. In standalone or sidecar mode, GuardianWAF sits in front of any HTTP backend: Node.js, Python, Java, PHP, Ruby, .NET, or Go. Only the embedded middleware mode requires a Go application.
02What does zero dependencies actually mean?+
The core WAF is built with the Go standard library, with no external Go module dependencies. The dashboard is embedded into the binary. Optional integrations, such as AI providers or Docker discovery, connect to external services when you enable them.
03How is this different from a regex-based WAF?+
GuardianWAF uses tokenizer-based detection and configurable threat scoring. Its detectors inspect the structure of suspicious input, and combined findings determine whether a request passes, is logged, challenged, or blocked.
04Can I try it without blocking real requests?+
Yes. Start in monitor mode to inspect traffic and review findings before switching to enforce mode. Tune thresholds and exclusions for your own application before enforcing a policy.
05Is GuardianWAF free to use?+
The core WAF is open source under the MIT license, including for commercial use. The repository describes possible future enterprise offerings separately. Optional third-party AI services may have their own usage costs.
Give your app
a guardian.
Open source. Zero dependencies. Ready when you are.
go install github.com/guardianwaf/guardianwaf/cmd/guardianwaf@latest