SafeLine

SafeLine is a self-hosted Web Application Firewall (WAF) written in Go. It sits in front of your web applications as a reverse proxy, inspecting HTTP/S traffic before it reaches your servers. It's built for developers, sysadmins, and security teams who want to run their own firewall layer instead of relying solely on a managed cloud WAF, and who need protection against common web exploits, bots, and abusive traffic.

The project deploys as a reverse proxy in front of one or more backend applications. Traffic passes through SafeLine first, where it gets filtered against rules for common attack patterns, rate limits, and bot detection before being forwarded (or blocked). It's already running in production at scale, with reported deployments protecting over a million websites and handling tens of billions of requests daily.

Key features

• Attack blocking: detects and blocks SQL injection, XSS, code injection, OS command injection, CRLF injection, XXE, SSRF, path traversal, and other common web exploits.
• Rate limiting: throttles IP-based traffic to defend against DoS attempts, brute-force login attacks, and traffic surges.
• Anti-bot challenge: presents challenges that let human visitors through while blocking crawlers and automated bots.
• Authentication challenge: gates access behind a password prompt, useful for staging environments or admin panels you want to shield further.
• Dynamic protection: re-encrypts HTML and JS on each visit, making it harder for scrapers and automated tools to parse page content.
• Web ACL: lets you define access control lists to allow or deny traffic based on custom rules.
• Ecosystem plugins: includes an MCP server for AI-assisted management, plus integrations for Ingress-NGINX and Kong Gateway.

Ideal use cases

SafeLine fits teams that self-host their infrastructure and want firewall control at the network edge rather than depending entirely on a third-party CDN/WAF. It works well for protecting internal or external-facing web apps against injection attacks, credential stuffing, scraping bots, and HTTP flood attempts, especially where compliance or data residency rules prevent routing traffic through an external cloud provider.

It's also a reasonable fit if you're running Kubernetes ingress or an API gateway like Kong and want WAF rules applied at that layer through the provided plugins.

It's not the right choice if you want a fully managed, zero-maintenance WAF; you're responsible for deploying, updating, and tuning rules yourself. It's also not a substitute for application-level input validation or a full security review, it's a filtering layer, not a guarantee against every exploit. If your app is entirely static with no dynamic input surface, the attack-blocking features add less value, though rate limiting and bot defense can still help.

Installation

The README points to the official install guide for deployment steps rather than embedding raw commands, since setup involves the reverse proxy container and its dependencies. In general terms:

# Follow the official install guide for your OS/environment
# https://docs.waf.chaitin.com/en/GetStarted/Deploy

After installation, you add your web application behind SafeLine through its configuration interface, pointing it at your backend origin server. Configuration details for adding an application are documented separately:

# Add and configure a protected application
# https://docs.waf.chaitin.com/en/GetStarted/AddApplication

Users in mainland China are warned in the README that installing the international version may break connectivity to cloud services, and are pointed to a separate Chinese-language install doc for that region.

A live demo is available if you want to see the WAF's block pages, bot challenges, and dynamic protection behavior before deploying it yourself.