Tests description

  • Tests are performed using OWASP Core Ruleset v4 and go benchmarks.
  • The benchmark tool supports coraza v2, v3 and modsecurity.
  • Modsecurity is executed using CGO.
  • There are currently 4 test-cases and 7 variations:
    • JSON request: 1kb and 100kb payload
    • URLENCODED request: 1kb and 100kb payload
    • Multipart file upload: 1kb and 100kb payload
    • GET request: no body


Machine specs: Apple M1 Pro (10 cores, 16 GB RAM)

Values are requests analyzed per second. The higher the value, the better results.

TestCoraza v2Coraza v3Modsecurity
Simple JSON Request6399031011
Giant JSON Request603908847
Multipart Request606817976
Giant Multipart Request573781958
Simple GET Request6549551135
Simple URLENCODED Request624892842
Giant URLENCODED Request632871840

Test Versions:

  • Coraza v3: v3.0.0-dev (no tag)
  • Coraza v2: v2.0.1
  • Modsecurity v3: v3.0.7

Run your own benchmarks

Using golang

# compile modsecurity:
git clone
cd coraza-benchmark
go test -bench=. ./...

Using Docker

docker run jptosso/coraza-benchmark:latest