The Multi-Site Use Case
You run a VPS with 3 sites: a WordPress blog on blog.example.com, a SaaS app on app.example.com, and a static landing page on example.com. You want one WAF to protect all three — no per-site overhead.
Adding Multiple Sites to SafeLine
In the SafeLine dashboard, Sites -> Add Site -> repeat for each domain:
Site 1: blog.example.com -> backend: wordpress:80
Site 2: app.example.com -> backend: app:3000
Site 3: example.com -> backend: nginx:80
All three sites route through the same SafeLine instance. The semantic engine inspects traffic for all of them independently.
Per-Site Rules Without Per-Site WAFs
Each site gets its own protection profile:
| Site | Rate Limiting | Geo-Blocking | Bot Protection | Custom Rules |
|---|---|---|---|---|
| Blog | 5/min on /wp-login | Block RU, CN, VN | ON | Block /xmlrpc.php |
| SaaS App | 100/min per API key | None (global product) | ON | Block mass assignment |
| Landing Page | Global 300/min | None | OFF | None |
This is all configured in one dashboard — no separate WAF installations, no per-site Docker containers, no added memory overhead beyond the single SafeLine deployment (~700 MB total for all sites).
SSL Certificate Management
SafeLine handles SSL for all three sites:
Site 1: Let's Encrypt auto-renew for blog.example.com
Site 2: Upload custom wildcard cert for *.example.com
Site 3: Also covered by the wildcard cert
Or terminate SSL at your existing Nginx/Caddy and have SafeLine work in plain HTTP behind it — your choice.
Resource Usage at Scale
SafeLine's resource usage scales efficiently with multiple sites:
| Sites Protected | RAM Usage | CPU at 100 req/s total |
|---|---|---|
| 1 | 700 MB | 15% |
| 3 | 730 MB | 22% |
| 10 | 780 MB | 45% |
The fixed overhead is PostgreSQL + management service (~500 MB). Each additional site adds minimal memory — just a few MB for the routing table. The Tengine container handles all the inspection work; adding more sites increases CPU linearly but memory barely budges.
Traffic Isolation
Sites are isolated at the routing layer:
- A security event on
blog.example.comdoesn't affectapp.example.com - Rate limits apply per-site, not globally (5/min on blog login doesn't affect SaaS app limits)
- Attack logs are tagged by site — you can filter by domain in the dashboard
Save Money: Replace Per-App Security Tools
Before SafeLine, you might have been using:
- A WordPress security plugin ($0-100/year per site)
- Cloudflare Pro for the SaaS app ($20/month)
- fail2ban + manual Nginx rules for the landing page (free but high maintenance)
After: one SafeLine instance ($0 for Community, $10/month for Lite) replaces all of it. The WordPress plugin goes away (WAF handles the same attacks). Cloudflare goes to free tier (WAF handles security, Cloudflare just does DNS). fail2ban gets simpler (WAF catches HTTP attacks, fail2ban only needs SSH).
FAQ
Can I mix HTTP and HTTPS sites on the same WAF?
Yes. Each site has its own SSL config. Blog can be HTTPS with Let's Encrypt while the landing page is HTTP-only. SafeLine handles the routing for both.
What if one site gets a huge traffic spike?
SafeLine Community Edition maxes at 800 QPS total. If one site spikes and you hit the cap, all sites are affected. Upgrade to the Lite plan ($10/month, no QPS cap) if you run high-traffic sites.
Can I give separate dashboard access to different clients?
Not in the Community Edition — one admin account. The Pro plan supports role-based access. For agency use, consider the upgrade.
How many sites are running on your VPS right now without any WAF in front?
Ready to protect your sites without paying for a cloud WAF?
- ⭐ SafeLine WAF on GitHub — give it a star if you find it useful
- 🔗 Official Docs — installation guide, configuration, and API reference
- 🧪 Live Demo — see the dashboard in action (no login required)
Top comments (0)