If you're paying for Cloudflare Pro or Business just for the WAF, or you're on the free tier and want actual protection, here's how to migrate to a self-hosted solution.
Step 1: Figure Out Why You're Switching
| Reason | What SafeLine Does Instead |
|---|---|
| Free tier detection too weak (10.7%) | Community Edition: 71.65% at $0 |
| Don't want to pay $20-200/month | Community Edition is completely free |
| Data privacy — third-party TLS termination | Traffic stays on your server |
| Need more than 5 custom rules | Unlimited custom rules with regex |
| Want per-route bot control | Bot protection configurable per route |
Step 2: Deploy SafeLine
On any Linux server with Docker:
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
This pulls the Docker images — Tengine reverse proxy, the semantic analysis engine, PostgreSQL for config and logs. Takes about 3 minutes. Access the dashboard at https://<your-server-ip>:9443.
Step 3: Route Traffic Through SafeLine
SafeLine binds ports 80/443 by default. If you already have a proxy on those ports, set SafeLine to an internal port:
Internet → Nginx/Caddy (443) → SafeLine (port 5080) → Your App (port 3000)
Or let SafeLine be the primary reverse proxy:
Internet → SafeLine (443) → Your App (port 3000)
Step 4: Add Your Sites
In the SafeLine dashboard, add each domain and point it to your backend IP and port. The semantic engine starts protecting immediately — no rule tuning needed.
Step 5: Recreate Your Cloudflare Rules
| Cloudflare Rule | SafeLine Equivalent |
|---|---|
| IP block | IP blacklist in dashboard |
| Rate limit (1 rule on free) | Unlimited rate limit rules |
| Country block (Enterprise) | GeoIP blocking — free |
| JS Challenge | JS/Captcha/Cookie Challenge |
| Custom rules (5 max, no regex) | Unlimited rules, full regex |
| Bot Fight Mode (global only) | Bot protection per route |
Step 6: DNS Cutover
If you're using Cloudflare's orange-cloud proxy, switch to grey-cloud (DNS only) or point nameservers back to your registrar. The WAF now lives on your server.
Step 7: Keep Cloudflare for CDN/DDoS (Optional)
You don't have to remove Cloudflare entirely:
User → Cloudflare DNS/CDN → SafeLine WAF → Your App
Cloudflare handles edge caching and DDoS. SafeLine handles application-layer detection. They complement each other.
Read the full comparison: SafeLine vs Cloudflare WAF: An Honest, Detailed Comparison — benchmark data, pricing breakdown, and when to use which.
FAQ
Will my site go down during the switch?
No. Deploy SafeLine, test with a staging subdomain, then cut over. You can run both simultaneously.
Do I need to change DNS?
Only if you want to stop using Cloudflare's proxy. You can keep Cloudflare for DNS only.
What about SSL?
SafeLine integrates with Let's Encrypt. Or terminate TLS at your existing reverse proxy and forward to SafeLine.
How much are you currently paying Cloudflare, and what's the main feature you'd miss?
Try SafeLine yourself: Live Demo | Website | Deploy Guide | Discord Community | More from CyberServal | LinkedIn
Top comments (0)