Registry for OWASP CRS plugins, official and 3rd party.
OWASP CRS allows for plugins. Yet the rule ID namespace needs to be coordinated. This repo serves as the official place to register plugins and reserve rule ID ranges.
The rule ID range from 9,500,000 - 9,999,999 is reserved for CRS plugins.
Plugins usually get a range of 1,000 IDs with the notable exception of the incubator plugin that maps the regular CRS IDs from 900K for each rule to the range 9,900,000 - 9,999,999.
| Plugin Name | Rule ID Range | Repository | Type | Status | CI | License |
|---|---|---|---|---|---|---|
| template | 9,500,000 - 9,500,999 | coreruleset/template-plugin | official | ✅ tested |  |
Apache-2.0 |
| auto-decoding | 9,501,000 - 9,501,999 | coreruleset/auto-decoding-plugin | official | untested | Apache-2.0 | |
| antivirus | 9,502,000 - 9,502,999 | coreruleset/antivirus-plugin | official | being tested | Apache-2.0 | |
| body-decompress | 9,503,000 - 9,503,999 | coreruleset/body-decompress-plugin | official | being tested |  |
Apache-2.0 |
| fake-bot | 9,504,000 - 9,504,999 | coreruleset/fake-bot-plugin | official | ✅ tested |  |
Apache-2.0 |
| google-oauth2 | 9,505,000 - 9,505,999 | coreruleset/google-oauth2-plugin | official | ✅ tested |  |
Apache-2.0 |
| drupal-rule-exclusions | 9,506,000 - 9,506,999 | coreruleset/drupal-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| wordpress-rule-exclusions | 9,507,000 - 9,507,999 | coreruleset/wordpress-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| nextcloud-rule-exclusions | 9,508,000 - 9,508,999 | coreruleset/nextcloud-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| dokuwiki-rule-exclusions | 9,509,000 - 9,509,999 | coreruleset/dokuwiki-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| cpanel-rule-exclusions | 9,510,000 - 9,510,999 | coreruleset/cpanel-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| xenforo-rule-exclusions | 9,511,000 - 9,511,999 | coreruleset/xenforo-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| phpbb-rule-exclusions | 9,512,000 - 9,512,999 | coreruleset/phpbb-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| phpmyadmin-rule-exclusions | 9,513,000 - 9,513,999 | coreruleset/phpmyadmin-rule-exclusions-plugin | official | ✅ tested |  |
Apache-2.0 |
| dos-protection-modsecurity | 9,514,000 - 9,514,999 | coreruleset/dos-protection-plugin-modsecurity | official | untested | Apache-2.0 | |
| machine-learning-integration-plugin | 9,516,000 - 9,516,999 | coreruleset/machine-learning-integration-plugin | official | draft |  |
Apache-2.0 |
| performance-plugin | 9,517,000 - 9,517,999 | coreruleset/performance-plugin | official | draft (Private) |  |
Apache-2.0 |
| ghost-rule-exclusions | 9,518,000 - 9,518,999 | coreruleset/ghost-rule-exclusions-plugin | official | draft (Private) |  |
Apache-2.0 |
| roundcube-rule-exclusions-plugin | 9,519,000 - 9,519,999 | EsadCetiner/roundcube-rule-exclusions-plugin | 3rd-party | ✅ tested |  |
GPL-2.0 |
| sogo-rule-exclusions-plugin | 9,520,000 - 9,520,999 | EsadCetiner/sogo-rule-exclusions-plugin | 3rd-party | ✅ tested |  |
GPL-2.0 |
| iredadmin-rule-exclusions-plugin | 9,521,000 - 9,521,999 | EsadCetiner/iredadmin-rule-exclusions-plugin | 3rd-party | ✅ tested |  |
GPL-2.0 |
| wordpress-hardening-plugin | 9,522,000 - 9,522,999 | eilandert/wordpress-hardening-plugin | 3rd-party | ✅ tested |  |
Apache-2.0 |
| database-logging-plugin | 9,523,000 - 9,523,999 | coreruleset/database-logging-plugin | official | untested | Apache-2.0 | |
| referer-hardening-plugin | 9,524,000 - 9,524,999 | coreruleset/referer-hardening-plugin | official | ✅ tested |  |
Apache-2.0 |
| false-positive-report-plugin | 9,525,000 - 9,525,999 | coreruleset/false-positive-report-plugin | official | ✅ tested |  |
Apache-2.0 |
| traffic-observation-plugin | 9,526,000 - 9,526,999 | coreruleset/traffic-observation-plugin | official | untested |  |
Apache-2.0 |
| netnea-crs-upgrading-plugin | 9,527,000 - 9,527,999 | netnea/netnea-crs-upgrading-plugin | 3rd-party | untested | GPL-3.0 | |
| plausible-rule-exclusions-plugin | 9,528,000 - 9,528,999 | EsadCetiner/plausible-rule-exclusions-plugin | 3rd-party | ✅ tested |  |
GPL-2.0 |
| vimbadmin-crs-plugin | 9,529,000 - 9,529,999 | eilandert/vimbadmin-crs-plugin | 3rd-party | ✅ tested |  |
Apache-2.0 |
| incubator | 9,900,000 - 9,999,999 | coreruleset/incubator-plugin | official | being tested | Apache-2.0 |
This table is generated from registry.yaml; do not edit it by hand.
A machine-readable registry.json is published alongside it for tooling
that wants to discover and install plugins without parsing this file.
See docs/registry-schema.md for what the registry attests
(and what it does not), and docs/plugin-descriptor-schema.md
for the plugin.yaml descriptor that each plugin repository provides.
To register a new plugin, open a PR adding it to registry.yaml.