SafeLine is a self-hosted WAF that protects web applications by filtering and monitoring HTTP/S traffic between the app and the Internet. The official home page describes it as a shield placed between the web application and the Internet, where clients pass through the WAF before reaching the server (https://docs.waf.chaitin.com/en/home). The Add Application guide explains the mechanism in more detail: SafeLine is built on nginx and acts as an HTTP/HTTPS reverse proxy that receives traffic for the original website, strips malicious requests, and forwards safe traffic upstream (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).
Inside that pipeline, the detection configuration decides how the WAF treats ambiguous requests. The official effect evaluation compares two SafeLine configurations, Balance and Strict, against 33,669 total samples. Balance detected 71.65% of attacks with a 0.07% false positive rate and 99.45% accuracy. Strict detected 76.17% with a 0.22% false positive rate and 99.38% accuracy (https://docs.waf.chaitin.com/en/home).
Balance is the precision-first option. It posts the highest accuracy of the two and keeps false positives very low, at the cost of catching fewer malicious samples. Strict is the recall-first option. It catches a larger share of attacks, at the cost of roughly three times the false positive rate and a slightly lower accuracy score.
That makes the decision a genuine tradeoff rather than a quality ranking. Balance fits surfaces where a false block is expensive, such as checkout flows, partner-facing APIs, or content pages where blocking a real visitor breaks a journey. Strict fits surfaces where a miss is expensive, such as login endpoints, admin consoles, and applications that are already receiving automated probes.
The supplied documentation presents these configurations in the evaluation results rather than as a step-by-step switch guide. Treat the profile change as a console-level detection setting and always validate it against your own traffic before relying on it in production.
What is the difference between Balance and Strict?
Balance and Strict are two detection configurations listed in SafeLine's official evaluation. On the same 33,669-sample set, Balance detected 71.65% of malicious samples with a 0.07% false positive rate and 99.45% accuracy, while Strict detected 76.17% with a 0.22% false positive rate and 99.38% accuracy (https://docs.waf.chaitin.com/en/home). Balance favors fewer false alarms; Strict favors catching more attacks.
Which profile should I choose?
Choose Balance when false positives are costly: payment flows, API gateways, SEO-critical pages, or any path where a blocked legitimate request creates friction or revenue loss. Choose Strict when missed attacks are costly: authentication endpoints, management interfaces, or applications under frequent automated attack. When unsure, start with Balance because it pairs high accuracy with a very low false positive rate, then move sensitive surfaces to Strict and watch the results.
Does a stricter configuration always mean better security?
No. Strict catches more malicious traffic, but the official numbers show it also produces more false positives and a marginally lower accuracy score (https://docs.waf.chaitin.com/en/home). A configuration that blocks legitimate users can lead operators to disable rules, loosen thresholds, or ignore alerts, which can weaken real-world protection. Effective security comes from matching the configuration to the application's risk posture and monitoring outcomes.
How do I apply the change?
The supplied documentation describes SafeLine as managed through its web console and configured at the application level (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). The exact click path for switching between Balance and Strict is not detailed in these sources, so do not assume a specific menu or command. Locate the detection or security policy setting in your console, change the profile, and then confirm the new behavior with test traffic such as the sample attack URLs shown in the Add Application guide (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).
Should I test before and after switching?
Yes. SafeLine sits in the live request path as a reverse proxy, so a profile change affects every request that passes through it. After switching, replay both normal traffic and the sample attack requests from the Add Application guide, and use the console's attack list to inspect details (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Confirm that legitimate requests still pass and that obvious attacks are blocked before considering the change complete.
SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.
- SafeLine website: https://ly.cyberserval.tech/bvK1BAV
- Demo: https://demo.waf.chaitin.com:9443/statistics
- Official docs: https://docs.waf.chaitin.com/en/home
- GitHub: https://github.com/chaitin/SafeLine
- Pro offer: https://cyberserval.tech/landing/lto
Top comments (0)