If you're paying for Cloudflare Pro or Business just for the WAF, or you're on the free tier and want actual protection, here's how to migrate to a self-hosted solution.
| Reason | What SafeLine Does Instead |
|---|
| Free tier detection too weak (10.7%) | Community Edition: 71.65% at $0 |
| Don't want to pay $20-200/month | Community Edition is completely free |
| Data privacy | Traffic stays on your server |
| Need more than 5 custom rules | Unlimited custom rules with regex |
| Want per-route bot control | Bot protection configurable per route |
Step 2: Deploy SafeLine
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Dashboard at https://<your-server-ip>:9443. Takes about 3 minutes.
Step 3: Route Traffic Through SafeLine
Internet -> Nginx/Caddy (443) -> SafeLine (port 5080) -> Your App (port 3000)
Or let SafeLine be the primary reverse proxy.
Step 4: Add Your Sites
In the SafeLine dashboard, add each domain with its backend IP and port. Protection starts immediately.
Step 5: Recreate Your Cloudflare Rules
| Cloudflare Rule | SafeLine Equivalent |
|---|
| IP block | IP blacklist in dashboard |
| Rate limit (1 rule) | Unlimited rate limit rules |
| Country block (Enterprise) | GeoIP blocking — free |
| Custom rules (5 max) | Unlimited rules, full regex |
| Bot Fight Mode (global only) | Bot protection per route |
Step 6: DNS Cutover
Switch Cloudflare from orange-cloud to grey-cloud (DNS only) if you want to remove the proxy entirely.
Step 7: Keep Cloudflare for CDN/DDoS
User -> Cloudflare DNS/CDN -> SafeLine WAF -> Your App
FAQ
Will my site go down during the switch?
No. Run both during migration, then cut over.
Do I need to change DNS?
Only to remove Cloudflare's proxy. Keep it for DNS/CDN.
What about SSL?
SafeLine integrates with Let's Encrypt. Or keep SSL at your existing proxy.
Try SafeLine yourself: Live Demo | Website | Deploy Guide | Discord Community | More from CyberServal | LinkedIn