What I Tested
| Factor | Setup |
|---|---|
| Server | 2 vCPU, 2 GB RAM VPS |
| Stack | Nginx -> SafeLine (Docker) -> Node.js app |
| Tool | Apache Bench, wrk, curl timing |
| Baseline | Direct to Node.js app (no WAF) |
| WAF mode | SafeLine Community, balanced detection profile |
Results
| Metric | Direct (No WAF) | Through SafeLine | Difference |
|---|---|---|---|
| Average response | 12ms | 13ms | +1ms |
| Requests/sec | 8,200 | 7,600 | -7.3% |
| p99 latency | 45ms | 48ms | +3ms |
| Resource usage | 400 MB RAM | 1.1 GB RAM | +700 MB |
The WAF adds about 1 millisecond of latency. Under load, throughput drops about 7%. For the vast majority of sites, this is invisible — your database queries and template rendering add 50-200ms, so an extra 1ms is noise.
What Actually Adds Latency (Hint: It's Not the WAF)
If your site feels slow, the WAF isn't the problem. Check these first:
- Database queries without indexes -> 50-500ms
- Unoptimized images -> seconds of load time
- No CDN for static assets -> 100-500ms per asset
- PHP without opcache -> 50-200ms per request
- Too many third-party scripts -> 2-5 seconds
An extra 1ms from WAF inspection is the last thing to worry about.
When Throughput Matters
SafeLine Community Edition caps at about 800 QPS on a single core. That's 69 million requests per day — far beyond what most sites handle. If you're running at that scale, the $10 Lite plan removes the cap.
For homelabs, small businesses, and most SaaS apps, you'll never hit it.
Resource Usage
SafeLine adds about 700 MB of baseline RAM usage across its containers. On a 2 GB VPS, that leaves about 900 MB for your app. Most Node.js, Python, or PHP apps run comfortably in that range.
| Total VPS RAM | SafeLine | Left for Apps | Works for |
|---|---|---|---|
| 1 GB | 700 MB | ~300 MB | Static sites, tiny APIs |
| 2 GB | 700 MB | ~1.3 GB | Most web apps |
| 4 GB | 700 MB | ~3.3 GB | WordPress, Rails, Django |
Verdict: 2 GB is the sweet spot. 1 GB works but is tight. 4 GB is comfortable.
The Performance Trade-Off
| Without WAF | With SafeLine |
|---|---|
| 8,200 req/s | 7,600 req/s |
| 12ms response | 13ms response |
| 0% attack blocking | 71.65% attack blocking |
| Every SQL injection reaches your app | SQL injection blocked at the proxy |
Trading 7% throughput for 71% attack blocking — a reasonable trade.
FAQ
Does the semantic engine get slower with more rules?
No. The engine parses request structure once and classifies attacks in a single pass. Detection time is constant regardless of how many attack types you're protecting against.
How does SafeLine's performance compare to ModSecurity?
ModSecurity can add 5-50ms of latency depending on rule set complexity. SafeLine stays at about 1ms because of single-pass semantic parsing. At 10,000 req/s, ModSecurity could cost you 50-500ms per request versus SafeLine's 1ms.
What about RAM usage under heavy load?
SafeLine's memory usage is stable under load. I tested 500 req/s for an hour: RAM stayed at about 700 MB the entire time. No memory leaks. PostgreSQL attack logs grow over time but the dashboard lets you set retention policies.
Can I run SafeLine on a Raspberry Pi?
Yes. A Pi 4 with 4 GB RAM handles SafeLine plus lightweight apps. ARM Docker images work. Throughput ceiling is lower (around 300-400 QPS on ARM), but it's a perfectly viable homelab setup.
How many requests per second does your site handle at peak, and what's your current security setup?
Top comments (0)