DEV Community

Lia
Lia

Posted on

How to Protect Multiple Websites with One WAF Instance

The Multi-Site Use Case

You run a VPS with 3 sites: a WordPress blog on blog.example.com, a SaaS app on app.example.com, and a static landing page on example.com. You want one WAF to protect all three — no per-site overhead.

Adding Multiple Sites to SafeLine

In the SafeLine dashboard, Sites -> Add Site -> repeat for each domain:

Site 1: blog.example.com -> backend: wordpress:80
Site 2: app.example.com  -> backend: app:3000
Site 3: example.com      -> backend: nginx:80
Enter fullscreen mode Exit fullscreen mode

All three sites route through the same SafeLine instance. The semantic engine inspects traffic for all of them independently.

Per-Site Rules Without Per-Site WAFs

Each site gets its own protection profile:

Site Rate Limiting Geo-Blocking Bot Protection Custom Rules
Blog 5/min on /wp-login Block RU, CN, VN ON Block /xmlrpc.php
SaaS App 100/min per API key None (global product) ON Block mass assignment
Landing Page Global 300/min None OFF None

This is all configured in one dashboard — no separate WAF installations, no per-site Docker containers, no added memory overhead beyond the single SafeLine deployment (~700 MB total for all sites).

SSL Certificate Management

SafeLine handles SSL for all three sites:

Site 1: Let's Encrypt auto-renew for blog.example.com
Site 2: Upload custom wildcard cert for *.example.com
Site 3: Also covered by the wildcard cert
Enter fullscreen mode Exit fullscreen mode

Or terminate SSL at your existing Nginx/Caddy and have SafeLine work in plain HTTP behind it — your choice.

Resource Usage at Scale

SafeLine's resource usage scales efficiently with multiple sites:

Sites Protected RAM Usage CPU at 100 req/s total
1 700 MB 15%
3 730 MB 22%
10 780 MB 45%

The fixed overhead is PostgreSQL + management service (~500 MB). Each additional site adds minimal memory — just a few MB for the routing table. The Tengine container handles all the inspection work; adding more sites increases CPU linearly but memory barely budges.

Traffic Isolation

Sites are isolated at the routing layer:

  • A security event on blog.example.com doesn't affect app.example.com
  • Rate limits apply per-site, not globally (5/min on blog login doesn't affect SaaS app limits)
  • Attack logs are tagged by site — you can filter by domain in the dashboard

Save Money: Replace Per-App Security Tools

Before SafeLine, you might have been using:

  • A WordPress security plugin ($0-100/year per site)
  • Cloudflare Pro for the SaaS app ($20/month)
  • fail2ban + manual Nginx rules for the landing page (free but high maintenance)

After: one SafeLine instance ($0 for Community, $10/month for Lite) replaces all of it. The WordPress plugin goes away (WAF handles the same attacks). Cloudflare goes to free tier (WAF handles security, Cloudflare just does DNS). fail2ban gets simpler (WAF catches HTTP attacks, fail2ban only needs SSH).

FAQ

Can I mix HTTP and HTTPS sites on the same WAF?

Yes. Each site has its own SSL config. Blog can be HTTPS with Let's Encrypt while the landing page is HTTP-only. SafeLine handles the routing for both.

What if one site gets a huge traffic spike?

SafeLine Community Edition maxes at 800 QPS total. If one site spikes and you hit the cap, all sites are affected. Upgrade to the Lite plan ($10/month, no QPS cap) if you run high-traffic sites.

Can I give separate dashboard access to different clients?

Not in the Community Edition — one admin account. The Pro plan supports role-based access. For agency use, consider the upgrade.


How many sites are running on your VPS right now without any WAF in front?


Ready to protect your sites without paying for a cloud WAF?

Top comments (0)