# ModSecurity: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 20 judge labels across 1 category by 10 of 14 models. Page: https://www.gane.ai/index/it/vendors/modsecurity

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Web application firewalls](https://www.gane.ai/index/it/network/web-application-firewalls/index.md) | 2% | 7 | 50% | 20 |

## What the models said for it

- "Top Recommendation: ModSecurity (with OWASP Core Rule Set)" (Grok 4.20, WAF)
- "don't reject ModSecurity simply because it's older: its project says it is now under OWASP stewardship and actively maintained" (GPT-6 Luna, WAF)
- "ModSecurity or Coraza offer powerful, free protection with complete customization" (Kimi K2, WAF)
- "open‑source options like ModSecurity or BunkerWeb are excellent choices" (GLM 4.7 FlashX, WAF)

## And against it

- "Do not install this unless you are prepared to spend weeks maintaining the OWASP Core Rule Set (CRS). An unpatched open-source WAF is often less secure" (Qwen 3.7 Flash, WAF)
- "Deploying legacy self-hosted open-source WAF engines (like unmaintained ModSecurity v2/v3 builds) without active maintenance or rule updates." (Gemini 3.5 Flash, WAF)
- "Avoid purely open-source options like ModSecurity unless you have dedicated security staff" (Grok 4.20, WAF)
- "the tuning burden is too high and bot protection would be minimal" (DeepSeek V4 Flash, WAF)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 0 | 0 | 1 | 0 | 1 |
| Gemini 3.5 Flash | 0 | 0 | 1 | 1 | 2 |
| Perplexity Sonar | 0 | 0 | 0 | 0 | 0 |
| Grok 4.20 | 1 | 0 | 0 | 3 | 4 |
| Mistral Small | 0 | 0 | 1 | 0 | 1 |
| DeepSeek V4 Flash | 0 | 1 | 0 | 2 | 3 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 1 | 2 | 3 |
| Kimi K2 | 0 | 1 | 0 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 1 | 0 | 1 | 2 |
| MiniMax M2.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-6 Luna | 0 | 1 | 0 | 0 | 1 |
| Muse Glimmer 30B | 0 | 0 | 1 | 1 | 2 |

## Sources returned with these answers

The sites and pages cited by the answers that named ModSecurity, from 38 of the 48 answers that named it (only the models that return a source list).

### Domains cited

- wafplanet.com: 14
- g2.com: 13
- cloudflare.com: 12
- geekflare.com: 12
- openappsec.io: 11
- radware.com: 10
- atomicorp.com: 9
- developers.cloudflare.com: 9
- imperva.com: 9
- reddit.com: 9

### Pages cited

- https://geekflare.com/guides/best-web-application-firewall: 12
- https://g2.com/categories/web-application-firewall-waf/small-business: 9
- https://openappsec.io/post/best-waf-solutions-in-2024-2025-real-world-comparison: 9
- https://atomicorp.com/web-application-firewall-waf-costs-shouldnt-exclude-you: 7
- https://cloudflare.com/products/waf: 7
- https://spotsaas.com/list/web-application-firewall--waf--software/for-small-business: 7
- https://wafplanet.com/: 7
- https://wafplanet.com/best-waf-for/small-business: 7

## In its own words

What ModSecurity's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: an open source, cross-platform web application firewall (WAF) module (https://modsecurity.org/)
- For: web application defenders (https://modsecurity.org/)

## What it publishes

Every page modsecurity.org exposes, read 2026-09-29: 31 addresses. By kind, pages and the last 90 days:

- glossary or explainer: 2 pages, 0 in the last 90 days, latest 0001-01-01
- Recent: 0001-01-01 glossary or explainer: What is modsecurity http://modsecurity.org/faq/what-is-modsecurity
- Recent: 0001-01-01 glossary or explainer: What is the difference between modsecurity and crs http://modsecurity.org/faq/what-is-the-difference-between-modsecurity-and-crs

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.