Best alternatives to Shibuya in 2026

Most websites get probed constantly for known attack patterns: someone trying to sneak a SQL command into a search box, or a script tag into a comment field. A Web Application Firewall (WAF) is the layer that catches those attempts before they hit your actual application code, and Shibuya is a WAF you run yourself, as a reverse proxy in front of whatever you're protecting. Shibuya is a Rust-based WAF built on Cloudflare's Pingora proxy framework, running the OWASP Core Rule Set alongside custom rules to detect SQL injection, XSS, path traversal, command injection, server-side template injection, Log4Shell-style attacks and NoSQL injection. It supports hot-reloading rules without restarting the proxy, Redis-backed distributed rate limiting for multi-instance deployments, inspection of multipart form data and JSON request bodies, and a dashboard for monitoring traffic. Benchmarked latency is sub-millisecond (p99 of 1.60ms), which matters if you're adding it in front of a latency-sensitive service. It's source-available under the PolyForm Noncommercial license — free to self-host for non-commercial use, but not simply MIT/Apache-permissive for commercial deployment. At one GitHub star, it's genuinely early-stage, but the project is unusually upfront about its own limits: the README explicitly lists what it doesn't do yet, including response inspection, XML/SOAP support, request-body DoS protections, and an acknowledged broken ML classifier component.