NGINX Warden

High-speed Lua security module for NGINX & OpenResty to drop scanner bots, path traversal attacks, and sensitive file probes in worker memory.

NGINX Warden (github.com/routewarden/nginx-warden) runs directly inside NGINX worker memory using LuaJIT during the access_by_lua phase. It screens incoming HTTP requests in sub-milliseconds without adding proxy latency.

---

What Does NGINX Warden Do?

⚡ In-Memory LuaJIT Speed

Inspects incoming URLs directly in NGINX memory before proxying to your backend, adding virtually zero latency.

🛡️ Block Reconnaissance Bots

Catches automated vulnerability scans looking for .env, .git, backup archives, SQL dumps, and diagnostic endpoints.

🔍 Anti-Evasion Normalization

Stops directory traversal, double URL encoding, matrix parameters, and null-byte bypasses before evaluating regex rules.

🌍 IP & CIDR Whitelisting

Easily whitelist internal VPNs, office IPs, or trusted subnets using native X-Forwarded-For and X-Real-IP parsing.

---

30-Second Quick Start

Initialize NGINX Warden in nginx.conf and protect your location blocks:

http {    lua_package_path "/usr/local/openresty/site/lualib/?.lua;/etc/nginx/lua/lib/?.lua;/etc/nginx/lua/lib/?/init.lua;;";    init_by_lua_block {        local routewarden = require("resty.routewarden")        warden = routewarden.new({            enabled = true,            enable_default_patterns = true,            block_patterns = {                "(?i)^/admin(/.*)?$",                "(?i)^/api/internal(/.*)?$"            },            allowed_ips = {                "10.0.0.0/8",                "192.168.1.100"            }        })    }    server {        listen 80;        server_name example.com;        access_by_lua_block {            warden:check()        }        location / {            proxy_pass http://backend_upstream;        }    }}

---

Installation & Setup

Deploy the NGINX Warden Lua module into OpenResty or NGINX with lua-nginx-module:

Diff

services:  nginx:    image: openresty/openresty:alpine    ports:      - "80:80"      - "443:443"    volumes:      - ./lib/resty/routewarden:/usr/local/openresty/site/lualib/resty/routewarden:ro      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro

---

Explore the Documentation

Guide	Description
🚀 Getting Started	Docker setup, OpenResty installation, and lua-nginx-module configuration.
⚙️ Configuration Reference	Directives, options, and response configurations for nginx.conf.
💡 Recipes & Blueprints	Real-world NGINX configurations for API cloaking, honeypots, and allowlists.
📜 Changelog & Releases	Complete release history, OpenResty Lua updates, and migration notes.