There's a special kind of homelab denial where you'll happily spend three weekends getting GPU passthrough working on a mini PC, but the actual front door to your self-hosted services is still just... open. No WAF, no rate limiting, just Traefik doing its job and hoping for the best.
I was that guy for longer than I'd like to admit. So let's talk about what a Web Application Firewall actually is, why it's not the same thing as the firewall you already think you have, and why I ended up running SafeLine — and, more importantly, why I didn't just take its word for it.
Not that firewall — this firewall
When most people hear "firewall," they picture something blocking ports — stopping traffic that shouldn't be reaching a service at all. That's your network firewall, and you should absolutely still have one.
A WAF is a different layer entirely. It sits in front of a specific web application and inspects the actual content of requests that are already allowed through — the form fields, the URL parameters, the headers — looking for the kind of malicious content that a port-based firewall has no opinion on whatsoever. SQL injection, cross-site scripting, path traversal, bot traffic hammering a login form — none of that gets stopped by "only allow port 443," because on paper it's just... a normal HTTPS request. A WAF is what actually reads what's inside it.
Practically, it sits as a reverse proxy: your traffic hits the WAF first, gets inspected, and only gets forwarded on to the real application if it looks legitimate. Anything that doesn't gets stopped there and never reaches your app at all.
Why I went looking for one
I'd been running a few self-hosted services behind Traefik for a while, and the honest answer for "what's protecting the application layer" was: nothing, beyond whatever hygiene was baked into the apps themselves. Fine, mostly, right up until it isn't.
SafeLine kept coming up in the self-hosting/homelab space — open-source, self-hosted, its own detection engine rather than the older regex-heavy ModSecurity approach. So I put it in front of a couple of things and left it running.
That's usually where these homelab write-ups end — "I installed it, dashboard's nice, seems to work, moving on." And that's the bit that always bothered me a little, watching other people's reviews of security tooling. Nobody actually checks. Everyone repeats the marketing copy, flags the same two concerns (it's made in China, some features are paywalled), and moves on without testing either claim.
So I didn't move on.
I actually tried to break it
Rather than just clicking through the dashboard, I stood up a deliberately vulnerable test app — SQL injection you could drive a bus through, a login form with zero validation, stored XSS, the works — and threw real attacks at it. Manual payloads first, so you can actually see the mechanism, then a proper automated scan on top for something more thorough than three cherry-picked examples.
The number that actually matters: across the full test session, SafeLine blocked just under 6,000 of roughly 17,000 requests — a genuine block rate, not a screenshot of one payload getting caught. That's the difference between "I'm told this works" and "here's what happened when I pointed real attack tooling at it."
And I checked where it phones home
This is the part that annoys me most about most self-hosted software reviews — everyone flags the privacy concern, nobody opens Wireshark.
So I mirrored the switch port, watched the traffic from a separate machine, and found exactly two outbound connections — both HTTPS, both going to Chaitin's own infrastructure, both clearly named (challenge.rivers.chaitin.cn and tserver.rivers.chaitin.cn). I can't see inside encrypted traffic, and I won't pretend I can — but I can tell you precisely where it's going and roughly what it's likely for, rather than just gesturing vaguely at "it's Chinese, be careful."
That's really the whole point of self-hosting security tooling in the first place — you get to check. So check.
The bit that's not what you'd expect
Everyone assumes self-hosted, free-tier security software means a crippled trial dressed up as a product. SafeLine's free tier genuinely isn't that — identity/SSO, rate limiting, unlimited custom rules, all included, no paywall. The actual gate sits at a fairly modest tier above that for things like geo-blocking and threat-intel feeds, and Pro mostly adds scale and analytics rather than gatekeeping core protection. That's a more generous split than most WAFs in this space bother with.
Where SafeLine actually sits
It's not really competing with Cloudflare — that's a fully managed edge service, different category, different trade-offs around where your traffic actually goes. It's closer in spirit to something like BunkerWeb: self-hosted, your own box, your own data. The real technical difference is the detection approach — semantic analysis of what a request is actually trying to do, rather than pattern-matching against a known list of bad strings, which is roughly the difference between a bouncer who reads the room and one working strictly off a photo lineup.
So, worth running?
Yes, with the caveat I'd give anyone about any piece of self-hosted security software: it's a layer, not a replacement for actually fixing vulnerable code, and no WAF stops a sufficiently determined attacker with more time than a bored homelabber on a Saturday. But for the kind of automated scanning and common attack patterns that most self-hosted setups actually face day to day, it held up under real testing, and it's honest about where it sends things, once you go and look.
I've written up a full deployment guide — covering both the official one-line install script and a manual Docker Compose method if you'd rather see exactly what's being deployed before it touches your box — plus initial configuration for SSL, protection modes, and rate limiting. Worth a read if you're thinking about adding a WAF layer to your own stack.
And if you want to see the actual attack testing rather than just read about it, that's going up as a video too — full before-and-after numbers, the Wireshark capture, all of it. No marketing copy, just what actually happened when I pointed real tools at it.