Engine compatibility matrix
Engine compatibility matrix
Generated from compat/matrix.json by tools/matrix.py on 2026-10-06. Do not edit by hand; edit the JSON and rerun the tool. A name links to its specification entry; on the published site, rows where the engines differ are tinted.
- v2: ModSecurity v2 (owasp-modsecurity/ModSecurity branch v2/master, 2026-09)
- v3: libmodsecurity v3.0.16 (owasp-modsecurity/ModSecurity branch v3/master)
- coraza: Coraza v3.8.1 (corazawaf/coraza)
directives (64 of 91 in all engines)
actions (33 of 48 in all engines)
| Name | v2 | v3 | coraza | status |
|---|---|---|---|---|
accuracy | yes | yes | yes | Extended |
allow | yes | yes | yes | Core |
append | yes | - | - | Deprecated |
auditlog | yes | yes | yes | Core |
block | yes | yes | yes | Core |
capture | yes | yes | yes | Core |
chain | yes | yes | yes | Core |
ctl | yes | yes | yes | Core |
deny | yes | yes | yes | Core |
deprecatevar | yes | - | - | Deprecated |
drop | yes | yes | yes | Core |
exec | yes | yes | yes | Extended |
expirevar | yes | yes | yes | Extended |
id | yes | yes | yes | Core |
initcol | yes | yes | yes | Extended |
log | yes | yes | yes | Core |
logdata | yes | yes | yes | Core |
marker | yes | - | - | Deprecated |
maturity | yes | yes | yes | Extended |
msg | yes | yes | yes | Core |
multiMatch | yes | yes | yes | Core |
noauditlog | yes | yes | yes | Core |
nolog | yes | yes | yes | Core |
pass | yes | yes | yes | Core |
pause | yes | - | - | Deprecated |
phase | yes | yes | yes | Core |
prepend | yes | - | - | Deprecated |
proxy | yes | - | - | Deprecated |
redirect | yes | yes | yes | Core |
rev | yes | yes | yes | Extended |
sanitiseArg | yes | - | - | Deprecated |
sanitiseMatched | yes | - | - | Deprecated |
sanitiseMatchedBytes | yes | - | - | Deprecated |
sanitiseRequestHeader | yes | - | - | Deprecated |
sanitiseResponseHeader | yes | - | - | Deprecated |
setenv | yes | yes | yes | Extended |
setrsc | yes | yes | - | Extended |
setsid | yes | yes | - | Extended |
setuid | yes | yes | - | Extended |
setvar | yes | yes | yes | Core |
severity | yes | yes | yes | Core |
skip | yes | yes | yes | Extended |
skipAfter | yes | yes | yes | Core |
status | yes | yes | yes | Core |
t | yes | yes | yes | Core |
tag | yes | yes | yes | Core |
ver | yes | yes | yes | Core |
xmlns | yes | yes | - | Extended |
ctl (10 of 21 in all engines)
| Name | v2 | v3 | coraza | status |
|---|---|---|---|---|
auditEngine | yes | yes | yes | Core |
auditLogParts | yes | yes | yes | Core |
debugLogLevel | yes | - | yes | Extended |
forceRequestBodyVariable | yes | yes | yes | Core |
forceResponseBodyVariable | - | - | yes | Engine-specific |
hashEnforcement | yes | - | yes | Deprecated |
hashEngine | yes | - | yes | Deprecated |
parseXmlIntoArgs | yes | yes | - | Extended |
requestBodyAccess | yes | yes | yes | Core |
requestBodyLimit | yes | - | yes | Extended |
requestBodyProcessor | yes | yes | yes | Core |
responseBodyAccess | yes | - | yes | Extended |
responseBodyLimit | yes | - | yes | Extended |
responseBodyProcessor | - | - | yes | Engine-specific |
ruleEngine | yes | yes | yes | Core |
ruleRemoveById | yes | yes | yes | Core |
ruleRemoveByMsg | yes | - | yes | Extended |
ruleRemoveByTag | yes | yes | yes | Core |
ruleRemoveTargetById | yes | yes | yes | Core |
ruleRemoveTargetByMsg | yes | - | yes | Extended |
ruleRemoveTargetByTag | yes | yes | yes | Core |
operators (29 of 44 in all engines)
| Name | v2 | v3 | coraza | status |
|---|---|---|---|---|
beginsWith | yes | yes | yes | Core |
contains | yes | yes | yes | Core |
containsWord | yes | yes | - | Extended |
detectSQLi | yes | yes | yes | Core |
detectXSS | yes | yes | yes | Core |
endsWith | yes | yes | yes | Core |
eq | yes | yes | yes | Core |
fuzzyHash | yes | yes | - | Extended |
ge | yes | yes | yes | Core |
geoLookup | yes | yes | yes | Extended |
gsbLookup | yes | yes | - | Deprecated |
gt | yes | yes | yes | Core |
inspectFile | yes | yes | yes | Extended |
ipMatch | yes | yes | yes | Core |
ipMatchF | yes | yes | yes | - |
ipMatchFromDataset | - | - | yes | Engine-specific |
ipMatchFromFile | yes | yes | yes | Extended |
le | yes | yes | yes | Core |
lt | yes | yes | yes | Core |
noMatch | yes | yes | yes | Extended |
pm | yes | yes | yes | Core |
pmf | yes | yes | yes | - |
pmFromDataset | - | - | yes | Engine-specific |
pmFromFile | yes | yes | yes | Core |
rbl | yes | yes | yes | Extended |
restpath | - | - | yes | Engine-specific |
rsub | yes | yes | - | Deprecated |
rx | yes | yes | yes | Core |
rxGlobal | - | yes | - | Engine-specific |
streq | yes | yes | yes | Core |
strmatch | yes | yes | yes | Extended |
unconditionalMatch | yes | yes | yes | Core |
validateByteRange | yes | yes | yes | Core |
validateDTD | yes | yes | - | Extended |
validateHash | yes | yes | - | Extended |
validateNid | - | - | yes | Engine-specific |
validateSchema | yes | yes | yes | Extended |
validateUrlEncoding | yes | yes | yes | Core |
validateUtf8Encoding | yes | yes | yes | Core |
verifyCC | yes | yes | - | Extended |
verifyCPF | yes | yes | - | Extended |
verifySSN | yes | yes | - | Extended |
verifySVNR | - | yes | - | Engine-specific |
within | yes | yes | yes | Core |
transformations (33 of 38 in all engines)
| Name | v2 | v3 | coraza | status |
|---|---|---|---|---|
base64Decode | yes | yes | yes | Core |
base64DecodeExt | yes | yes | yes | Extended |
base64Encode | yes | yes | yes | Extended |
cmdLine | yes | yes | yes | Core |
compressWhitespace | yes | yes | yes | Core |
cssDecode | yes | yes | yes | Core |
escapeSeqDecode | yes | yes | yes | Core |
hexDecode | yes | yes | yes | Extended |
hexEncode | yes | yes | yes | Core |
htmlEntityDecode | yes | yes | yes | Core |
jsDecode | yes | yes | yes | Core |
length | yes | yes | yes | Core |
lowercase | yes | yes | yes | Core |
md5 | yes | yes | yes | Extended |
none | yes | yes | yes | Core |
normalisePath | yes | yes | yes | Core |
normalisePathWin | yes | yes | yes | Core |
normalizePath | yes | yes | yes | - |
normalizePathWin | yes | yes | yes | - |
parityEven7bit | yes | yes | - | Extended |
parityOdd7bit | yes | yes | - | Extended |
parityZero7bit | yes | yes | - | Extended |
removeComments | yes | yes | yes | Extended |
removeCommentsChar | yes | yes | yes | Core |
removeNulls | yes | yes | yes | Core |
removeWhitespace | yes | yes | yes | Core |
replaceComments | yes | yes | yes | Core |
replaceNulls | yes | yes | yes | Extended |
sha1 | yes | yes | yes | Core |
sqlHexDecode | yes | yes | - | Extended |
trim | yes | yes | yes | Extended |
trimLeft | yes | yes | yes | Extended |
trimRight | yes | yes | yes | Extended |
uppercase | - | yes | yes | Core (ADR-0012) |
urlDecode | yes | yes | yes | Extended |
urlDecodeUni | yes | yes | yes | Core |
urlEncode | yes | yes | yes | Extended |
utf8toUnicode | yes | yes | yes | Core |
variables (74 of 144 in all engines)
| Name | v2 | v3 | coraza | status |
|---|---|---|---|---|
ARGS | yes | yes | yes | Core |
ARGS_COMBINED_SIZE | yes | yes | yes | Core |
ARGS_GET | yes | yes | yes | Core |
ARGS_GET_NAMES | yes | yes | yes | Core |
ARGS_NAMES | yes | yes | yes | Core |
ARGS_PATH | - | - | yes | Engine-specific |
ARGS_POST | yes | yes | yes | Core |
ARGS_POST_NAMES | yes | yes | yes | Core |
ARGUMENTS_LIMIT_REACHED | - | - | yes | Engine-specific |
AUTH_TYPE | yes | yes | - | Extended |
DURATION | yes | yes | yes | Extended |
ENV | yes | yes | yes | Extended |
FILES | yes | yes | yes | Core |
FILES_COMBINED_SIZE | yes | yes | yes | Core |
FILES_NAMES | yes | yes | yes | Core |
FILES_SIZES | yes | yes | yes | Extended |
FILES_TMP_CONTENT | yes | yes | yes | Extended |
FILES_TMPNAMES | yes | yes | yes | Extended |
FULL_REQUEST | yes | yes | - | Extended |
FULL_REQUEST_LENGTH | yes | yes | yes | Extended |
GEO | yes | yes | yes | Extended |
GLOBAL | yes | yes | - | Extended |
HIGHEST_SEVERITY | yes | yes | yes | Extended |
INBOUND_DATA_ERROR | yes | yes | yes | Core |
IP | yes | yes | - | Extended |
JSON | - | - | yes | Engine-specific |
MATCHED_VAR | yes | yes | yes | Core |
MATCHED_VAR_NAME | yes | yes | yes | Core |
MATCHED_VARS | yes | yes | yes | Core |
MATCHED_VARS_NAMES | yes | yes | yes | Extended |
MODSEC_BUILD | yes | yes | - | Extended |
MSC_PCRE_ERROR | - | yes | - | Engine-specific |
MSC_PCRE_LIMITS_EXCEEDED | - | yes | - | Engine-specific |
MULTIPART_BOUNDARY_QUOTED | yes | yes | - | Extended |
MULTIPART_BOUNDARY_WHITESPACE | yes | yes | - | Extended |
MULTIPART_CRLF_LF_LINES | yes | yes | - | Extended |
MULTIPART_CRLF_LINE | yes | - | - | Deprecated |
MULTIPART_DATA_AFTER | yes | yes | yes | Extended |
MULTIPART_DATA_BEFORE | yes | yes | - | Extended |
MULTIPART_DUPLICATE_PART_HEADER | - | - | yes | Engine-specific |
MULTIPART_FILE_LIMIT_EXCEEDED | yes | yes | - | Extended |
MULTIPART_FILENAME | yes | yes | yes | Extended |
MULTIPART_FILENAME_CHARSET | - | - | yes | Engine-specific |
MULTIPART_FILENAME_LANGUAGE | - | - | yes | Engine-specific |
MULTIPART_HEADER_FOLDING | yes | yes | - | Extended |
MULTIPART_INVALID_HEADER_FOLDING | yes | yes | - | Extended |
MULTIPART_INVALID_PART | yes | yes | - | Extended |
MULTIPART_INVALID_QUOTING | yes | yes | yes | Extended |
MULTIPART_LF_LINE | yes | yes | - | Extended |
MULTIPART_MISSING_SEMICOLON | yes | yes | - | Extended |
MULTIPART_NAME | yes | yes | yes | Extended |
MULTIPART_PART_HEADERS | yes | yes | yes | Core |
MULTIPART_STRICT_ERROR | yes | yes | yes | Core |
MULTIPART_UNMATCHED_BOUNDARY | yes | yes | - | Extended |
OUTBOUND_DATA_ERROR | yes | yes | yes | Core |
PATH_INFO | yes | yes | - | Extended |
PERF_ALL | yes | - | - | Deprecated |
PERF_COMBINED | yes | - | - | Deprecated |
PERF_GC | yes | - | - | Deprecated |
PERF_LOGGING | yes | - | - | Deprecated |
PERF_PHASE1 | yes | - | - | Deprecated |
PERF_PHASE2 | yes | - | - | Deprecated |
PERF_PHASE3 | yes | - | - | Deprecated |
PERF_PHASE4 | yes | - | - | Deprecated |
PERF_PHASE5 | yes | - | - | Deprecated |
PERF_RULES | yes | - | - | Deprecated |
PERF_SREAD | yes | - | - | Deprecated |
PERF_SWRITE | yes | - | - | Deprecated |
QUERY_STRING | yes | yes | yes | Core |
REMOTE_ADDR | yes | yes | yes | Core |
REMOTE_HOST | yes | yes | yes | Extended |
REMOTE_PORT | yes | yes | yes | Extended |
REMOTE_USER | yes | yes | - | Extended |
REQBODY_ERROR | yes | yes | yes | Core |
REQBODY_ERROR_MSG | yes | yes | yes | Core |
REQBODY_PROCESSOR | yes | yes | yes | Core |
REQBODY_PROCESSOR_ERROR | - | yes | yes | Extended |
REQBODY_PROCESSOR_ERROR_MSG | - | yes | yes | Extended |
REQUEST_BASENAME | yes | yes | yes | Core |
REQUEST_BODY | yes | yes | yes | Core |
REQUEST_BODY_LENGTH | yes | yes | yes | Core |
REQUEST_COOKIES | yes | yes | yes | Core |
REQUEST_COOKIES_NAMES | yes | yes | yes | Core |
REQUEST_FILENAME | yes | yes | yes | Core |
REQUEST_HEADERS | yes | yes | yes | Core |
REQUEST_HEADERS_NAMES | yes | yes | yes | Core |
REQUEST_LINE | yes | yes | yes | Core |
REQUEST_METHOD | yes | yes | yes | Core |
REQUEST_PROTOCOL | yes | yes | yes | Core |
REQUEST_URI | yes | yes | yes | Core |
REQUEST_URI_RAW | yes | yes | yes | Core |
REQUEST_XML | - | - | yes | Engine-specific |
RES_BODY_ERROR | - | - | yes | Engine-specific |
RES_BODY_ERROR_MSG | - | - | yes | Engine-specific |
RES_BODY_PROCESSOR | - | - | yes | Engine-specific |
RES_BODY_PROCESSOR_ERROR | - | - | yes | Engine-specific |
RES_BODY_PROCESSOR_ERROR_MSG | - | - | yes | Engine-specific |
RESOURCE | yes | yes | - | Extended |
RESPONSE_ARGS | - | - | yes | Engine-specific |
RESPONSE_BODY | yes | yes | yes | Core |
RESPONSE_CONTENT_LENGTH | yes | yes | yes | Extended |
RESPONSE_CONTENT_TYPE | yes | yes | yes | Extended |
RESPONSE_HEADERS | yes | yes | yes | Core |
RESPONSE_HEADERS_NAMES | yes | yes | yes | Extended |
RESPONSE_PROTOCOL | yes | yes | yes | Extended |
RESPONSE_STATUS | yes | yes | yes | Core |
RESPONSE_XML | - | - | yes | Engine-specific |
RULE | yes | yes | yes | Extended |
SCRIPT_BASENAME | yes | - | - | Deprecated |
SCRIPT_FILENAME | yes | - | - | Deprecated |
SCRIPT_GID | yes | - | - | Deprecated |
SCRIPT_GROUPNAME | yes | - | - | Deprecated |
SCRIPT_MODE | yes | - | - | Deprecated |
SCRIPT_UID | yes | - | - | Deprecated |
SCRIPT_USERNAME | yes | - | - | Deprecated |
SDBM_DELETE_ERROR | yes | - | - | Deprecated |
SERVER_ADDR | yes | yes | yes | Extended |
SERVER_NAME | yes | yes | yes | Extended |
SERVER_PORT | yes | yes | yes | Extended |
SESSION | yes | yes | - | Extended |
SESSIONID | yes | yes | - | Extended |
STATUS | - | yes | - | Engine-specific |
STATUS_LINE | yes | - | yes | Extended |
STREAM_INPUT_BODY | yes | - | - | Deprecated |
STREAM_OUTPUT_BODY | yes | - | - | Deprecated |
TIME | yes | yes | yes | Extended |
TIME_DAY | yes | yes | yes | Extended |
TIME_EPOCH | yes | yes | yes | Extended |
TIME_HOUR | yes | yes | yes | Extended |
TIME_MIN | yes | yes | yes | Extended |
TIME_MON | yes | yes | yes | Extended |
TIME_SEC | yes | yes | yes | Extended |
TIME_WDAY | yes | yes | yes | Extended |
TIME_YEAR | yes | yes | yes | Extended |
TX | yes | yes | yes | Core |
UNIQUE_ID | yes | yes | yes | Core |
URI_PARSE_ERROR | - | - | yes | Engine-specific |
URLENCODED_ERROR | yes | yes | yes | Extended |
USER | yes | yes | - | Extended |
USERAGENT_IP | yes | - | - | Deprecated |
USERID | yes | yes | - | Extended |
WEBAPPID | yes | yes | - | Extended |
WEBSERVER_ERROR_LOG | yes | - | - | Deprecated |
XML | yes | yes | yes | Core |