SafeLine
SafeLine is a self-hosted Web Application Firewall (WAF) that protects your web apps from attacks like SQL injection, XSS, and bots.
Smart Download
Visit Project Homepage
No installer available yet — head to the source repository
Self-hosted WAF with high accuracy, low false positives, and built-in bot defense.
Core Features
- Block common web attacks (SQLi, XSS, command injection, etc.)
- IP-based rate limiting to prevent brute force and DDoS
- Anti-bot challenges (CAPTCHA) to distinguish humans
- Authentication challenges (password gate) for sensitive pages
- Dynamic encryption of HTML and JavaScript to prevent tampering
What It Can't Do
- •For users in mainland China, use the Chinese version to avoid cloud service connectivity issues. Always change the default admin password after first login.
Use Cases
- Small to medium websites/APIs needing low-cost security
- Compliance scenarios requiring on-premises, data-sovereign WAF
- Protecting CMS like WordPress, Joomla from known exploits
- High-traffic sites needing anti-scraping and rate limiting
Detailed Introduction
SafeLine is a self-hosted, open-source Web Application Firewall (WAF) designed to shield web applications from a wide range of attacks. It acts as a reverse proxy, filtering and monitoring HTTP traffic to block malicious requests before they reach your server. Key capabilities include defense against SQL injection, XSS, code injection, command injection, path traversal, CSRF, SSRF, and more. It also offers rate limiting to prevent brute force and DoS attacks, anti-bot challenges to distinguish humans from bots, authentication challenges for password-protected access, and dynamic encryption of HTML and JavaScript code to thwart tampering. With over 180,000 installations globally, SafeLine is production-ready and boasts a detection accuracy of 99.45% with a false positive rate of only 0.07%, significantly outperforming ModSecurity and CloudFlare free tier.
Troubleshooting & FAQ (2)
TroubleshootingWhy do I get 'SSLPeerUnverifiedException: Certificate pinning failure' after SafeLine auto-renews my SSL certificate?
**Root cause:** Before v9.4.3, SafeLine generated a new private key on every ACME certificate issuance/renewal. This changes the certificate's SPKI public key hash, which breaks apps using SSL pinning (e.g., Android OkHttp CertificatePinner) that pin the public key hash. Browsers and curl don't perform pinning, so server-side tests pass normally while all pinned app clients fail — and since the failure occurs during the TLS handshake, no requests appear in SafeLine or backend access logs.
**Fix:** Upgrade SafeLine to **v9.4.3 or later**, which supports reusing the existing private key on certificate renewal (equivalent to certbot's --reuse-key), keeping the public key hash stable across renewals. The feature is confirmed available in the official release.
**Workaround (pre-v9.4.3):** Manage the private key externally and upload the certificate manually instead of using SafeLine's automatic ACME issuance. Generate/obtain the certificate against your own fixed private key (e.g., with certbot --reuse-key or acme.sh), then upload both to SafeLine's site configuration, so renewals never rotate the key.
TroubleshootingWhy does the 'Reset to default' button on the Custom HTML 'Application Offline' page not work?
This is a confirmed bug: clicking 'Reset to default' on the Custom HTML → Application Offline settings page throws a JavaScript console error and does nothing, while other pages work normally. The bug has been fixed in the latest release. Update your installation to the newest version to resolve it. Until you can update, avoid using the reset button and manually clear or edit the custom HTML content instead.
Tags
Getting Started
Download installer
Click the button above to download the installer for your system
Install the software
Double-click the downloaded installer and follow the prompts
Step 1: Visit the official docs and choose your installation method (Docker is recommended)
Step 2: Run the install command, then access the admin console at https://your-server:9443
Step 3: Add a web application by providing its domain/IP and port
- Step 1: Visit the official docs and choose your installation method (Docker is recommended)
- Step 2: Run the install command, then access the admin console at https://your-server:9443
- Step 3: Add a web application by providing its domain/IP and port
Checksum not available
This project has not published a SHA-256 checksum on its GitHub Release page
SHA256 Checksum
No checksum available
Download directly from GitHub Releases and verify file integrity yourself
All SHA-256 checksums on this platform are extracted from the project's official GitHub Release page, without any modification. You can independently verify them on the GitHub Releases page.
Open Source Transparency
View GitHub SourceUninstall Info
Stop and remove containers and volumes: `docker compose down -v` (this deletes all configs and logs; backup first).
No Extra Dependencies
Ready to use after download. No additional runtime required.
Having issues? Check the FAQ below
2 FAQs
Similar Projects
PowerToys
A set of utilities for power users to tune and streamline their Windows experience for greater productivity.
terminal
Modern, feature-rich terminal application for Windows command-line users, with tabs, GPU acceleration, and full customization.
core
Open source home automation that puts local control and privacy first. Perfect for Raspberry Pi or a local server.