DEV Community

Lia
Lia

Posted on

SafeLine WAF Community Edition Limitations: What You Get for Free

#webdev #security #devops #selfhosted

SafeLine WAF Community Edition Limitations: What You Get for Free

SafeLine ships a free Community Edition that you can run on your own server with no time limit and no feature trial. That makes it one of the few self-hosted WAFs you can actually put in front of production traffic without pulling out a credit card. But "free" does come with a ceiling, and it's worth knowing exactly where that ceiling sits before you commit.

This article walks through what the Community Edition includes, the two hard limits you'll hit, and the point at which stepping up to a paid tier makes sense.

What the Community Edition actually gives you

The free tier is not a stripped-down demo. It's the same detection engine that powers the paid plans, just with capacity caps. Concretely, the Community Edition covers:

  • Up to 10 applications behind the WAF.
  • Up to 800 QPS (queries per second) of protected traffic.
  • The core semantic detection engine — the part that blocks SQL injection, XSS, bot traffic, and common web exploits without signature tuning.
  • A management console, logs, and the reverse-proxy mode that sits in front of your upstream services.

If your setup fits inside those two numbers, you get the full protective value of SafeLine at zero cost. For a personal site, a small portfolio of internal tools, or a handful of low-traffic services, that's often the entire story.

Where the limits actually bite

There are exactly two hard constraints on the Community Edition, and both are about scale rather than features:

  1. 10 applications. Each protected site or API counts as one app. Once you pass ten, you can't add more on the free tier.
  2. 800 QPS. This is the throughput ceiling for inspected traffic. Bursts above it won't be denied outright, but you've left the envelope the free tier is sized for.

Notice what isn't limited: there's no expiry, no blocked attack category, and no "contact sales after 14 days" wall. The limits are capacity, not capability. That's a meaningful difference from vendors who gate the actual protection behind a paid plan.

When it's time to move up

If you're consistently near either cap — or you simply expect to grow past it — SafeLine offers two paid tiers that lift the ceilings rather than change how the WAF behaves:

  • Lite — roughly $10/month, raising the cap to 20 applications. A small step up for growing teams.
  • Pro — roughly $100/month, with unlimited applications for larger estates.

Because the detection engine is identical across tiers, upgrading is about headroom, not about suddenly getting better protection. You move up when your app count or traffic volume demands it, not because the free tier is "missing" a feature.

Getting started on the free tier

The fastest way to see the Community Edition in action is the one-line installer, which brings up the whole stack (console, detection engine, database, cache) as containers:

bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Enter fullscreen mode Exit fullscreen mode

Once it finishes, open the console at https://<your-server-ip>:9443, add your first site, and point its upstream at your app. You're now protecting up to 10 applications at 800 QPS for free.

FAQ

Is the Community Edition a time-limited trial?

No. It's free to run indefinitely. The only constraints are the 10-app and 800-QPS ceilings.

What happens if I exceed 800 QPS?

The limit is a sizing ceiling, not a hard cutoff that starts dropping traffic. But if you're consistently above it, a paid tier gives you the headroom to run comfortably.

Do I lose any protection features on the free tier?

The detection capabilities are the same across tiers. Paid plans raise the app and throughput limits; they don't unlock a separate set of WAF features.

Can I switch from Community to Pro later?

Yes. Since the engine is the same, moving up is a licensing change that lifts the caps — your configuration and protected sites carry over.

Ready to protect your sites without paying for a cloud WAF?

Top comments (0)