A web application firewall (WAF) sits between your application and the internet, filtering, monitoring, and blocking malicious HTTP and HTTPS traffic before it reaches the server. SafeLine is a self-hosted WAF that works as an HTTP/HTTPS reverse proxy built on nginx: it receives traffic for the original website, removes malicious requests, and forwards safe traffic to the upstream application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication). Its documented protections cover SQL injection, XSS, code injection, OS command injection, CRLF injection, LDAP injection, XPath injection, RCE, XXE, SSRF, path traversal, backdoors, brute force, HTTP floods, and bot abuse (https://docs.waf.chaitin.com/en/home).

To write meaningful allow and deny rules for one application, you first need a working install and a correctly proxied app. The steps below follow the official setup flow.

Deploy the WAF

  1. Check the host. The documented minimums are a Linux operating system, x86_64 or arm64 architecture, Docker 20.10.14 or later, Docker Compose 2.0.0 or later, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk (https://docs.waf.chaitin.com/en/GetStarted/Deploy). Confirm with uname -m, docker version, docker compose version, free -h, and df -h.
  2. Run the installer. The recommended automatic install requires root privileges: bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en (https://docs.waf.chaitin.com/en/GetStarted/Deploy).
  3. For a manual install, install Docker, create /data/safeline, download the compose.yaml file, fill the .env file with the documented variables, generate the required secrets, and run docker compose up -d (https://docs.waf.chaitin.com/en/GetStarted/Deploy).
  4. Open the console. Visit https://:9443/ in a browser (https://docs.waf.chaitin.com/en/GetStarted/Deploy).
  5. Create the administrator. Run docker exec safeline-mgt resetadmin, record the initial username and password, then log in (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

Proxy the Application

  1. Go to the Applications page and click Add Application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).
  2. Enter the Domain, which is the app's domain name, hostname, or IP address, the Port that SafeLine will listen on such as 80 or 443, and the Upstream, which is the real address of the original app. Check the SSL option for HTTPS apps (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).
  3. Resolve the domain name to the IP address of the SafeLine server so traffic flows through the WAF before reaching the application (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Design the Allow and Deny Rules

SafeLine lists a Web Access Control List among its core capabilities, alongside defenses for web attacks, proactive bot abuse defense, HTML and JS code encryption, and IP-based rate limiting (https://docs.waf.chaitin.com/en/home). The official documentation details the install and proxying flow, so treat rule construction as a decision checklist grounded in the documented capabilities.

  1. Allow only what must reach the app, such as your own monitoring or health-check sources, trusted administrator networks, and known static asset paths.
  2. Deny what should never reach the app, such as IP addresses, ranges, or user agents you have already identified as malicious in your logs.
  3. Apply IP-based rate limiting to throttle brute force attempts, traffic surges, and other abuse that exceeds defined limits (https://docs.waf.chaitin.com/en/home).
  4. Add a Captcha Challenge so human users are allowed while crawlers and bots are blocked (https://docs.waf.chaitin.com/en/home).
  5. Enable an Authentication Challenge for visitors who must enter a password before they are allowed through (https://docs.waf.chaitin.com/en/home).
  6. Verify each rule with the documented attack test cases, including SQL injection, XSS, path traversal, code injection, and XXE payloads, and watch for the blocking page (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

Frequently Asked Questions

Which host requirements do I need before installing?

Linux, x86_64 or arm64, Docker 20.10.14 or later, Docker Compose 2.0.0 or later, and at least 1 CPU core, 1 GB of memory, and 5 GB of disk (https://docs.waf.chaitin.com/en/GetStarted/Deploy).

How do I proxy a single application?

From the Applications page, add an application with its Domain, the Port SafeLine should listen on, and the Upstream address, then resolve the domain to the SafeLine server IP (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

What is the difference between an allow rule and a deny rule?

An allow rule grants access to trusted sources such as internal networks or health checks, while a deny rule blocks known bad IPs or patterns. Because SafeLine is a reverse proxy, traffic reaches the application only after passing through the WAF (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

How do I confirm the protection is active?

Send the documented attack test cases, including SQL injection and path traversal, and look for the blocking page in the browser (https://docs.waf.chaitin.com/en/GetStarted/AddApplication).

SafeLine has surpassed 700,000 installations worldwide as of September 30, 2026. SafeLine Pro annual promotional pricing is $650-$880, compared with the regular $1,000 per year.