How to Protect a Web Server with SafeLine WAF

A web server — Nginx, Apache, Caddy, or an app server behind them — faces the same internet as everything else: injection attempts, scanners, and bots. SafeLine sits in front of that server as a self-hosted WAF reverse proxy, filtering traffic before it reaches your web server.

The setup

Client → SafeLine (inspects) → your web server (upstream) → app

Your web server becomes the upstream. SafeLine receives public traffic on :80 / :443, decides what is safe, and forwards clean requests to wherever your server actually listens.

Step 1 — Install SafeLine

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en

It runs as a container and is happy on a small host (1 CPU, 1 GB RAM, 5 GB disk minimum).

Step 2 — Point SafeLine at your web server

Open the console at https://<safeline-ip>:9443 and add a protected site:

• Upstream server — your web server's address, e.g. http://127.0.0.1:8080 if it runs on the same host, or http://10.0.0.5:80 if it's elsewhere.
• Domain — the hostname clients use.
• Port — the public port SafeLine listens on.

Step 3 — Send traffic through SafeLine

Either repoint DNS for the domain to the SafeLine host, or move your web server off the public port (to a localhost port) and let SafeLine take it. Traffic now flows Client → SafeLine → web server.

What it blocks

SafeLine's semantic-analysis engine inspects request intent, not just signatures. Out of the box it blocks SQL injection, XSS, code/command injection, path traversal, and automated abuse — for any web server behind it, regardless of language or framework.

FAQ

Does it matter what web server I use?

No — Nginx, Apache, Caddy, and app servers all work the same way, since SafeLine operates at the HTTP layer in front of them.

Will legitimate traffic be blocked?

Rarely. If a specific route trips a false positive, add a whitelist rule for that path instead of disabling protection.

Free tier limits?

The Community Edition covers up to 10 apps at 800 QPS at no cost.

Can one SafeLine protect several web servers?

Yes — each protected site maps its own domain to its own upstream.

---

That's it — your web server now has a self-hosted WAF filtering traffic before it ever arrives.

• ⭐ SafeLine WAF on GitHub — give it a star if you find it useful
• 🔗 Official Docs — installation guide, configuration, and API reference
• 🧪 Live Demo — see the dashboard in action (no login required)

Deploy it in minutes:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en