Why Small Businesses Get Targeted
Attackers don't just go after banks and hospitals. They scan for vulnerable WordPress installs, unpatched plugins, and exposed admin panels — the kind of things small business sites have by the dozen. The average WordPress site gets probed by automated attack scripts within hours of going live. A WAF is the cheapest insurance you can buy.
What You Need (and Don't Need)
| Need | Don't Need |
|---|
| SQL injection protection | Enterprise DDoS scrubbing |
| XSS and bad bot blocking | 24/7 SOC team |
| Rate limiting on login pages | $2,000/month enterprise WAF |
| SSL/TLS handling | CDN with 300+ edge nodes |
| A dashboard to see what's blocked | Compliance reporting |
The $0 Stack
User → SafeLine WAF (free) → Your App (Docker on VPS)
SafeLine Community Edition handles everything on the "Need" list. It runs on the same VPS as your app — a $10-20/month instance handles both comfortably.
Step 1: Deploy
bash -c "$(curl -fsSLk https://waf.chaitin.com/release/latest/manager.sh)" -- --en
Dashboard: https://your-ip:9443. Three minutes.
Step 2: Add Your Site
Point SafeLine to your app (e.g., localhost:3000 or your Docker container). Protection starts immediately.
Step 3: Essential Rules
Set these up once:
- Rate limit login pages to 5 requests/minute per IP
- Bot protection on login forms, checkout pages, and contact forms
- Geo-block countries you don't serve (reduces noise by 60-80%)
- IP blacklist for anything repeatedly triggering alerts
Step 4: Upgrade Later If You Need To
The $10/month Lite plan adds:
- 20 applications instead of 10
- Priority community support
- Higher throughput ceiling
The $100/month Pro plan is overkill for most small businesses.
FAQ
Do I really need a WAF if I keep WordPress updated?
Yes. Vulnerabilities exist in themes, plugins, and zero-day exploits that haven't been patched yet. A WAF catches attacks before they reach your application.
Is the free version actually production-ready?
Yes. 180,000+ installations worldwide. 1M+ websites protected. The Community Edition uses the same detection engine as Pro — the limits are on apps, throughput, and support, not on protection quality.
Can it run on the same VPS as my app?
Yes. 1 GB RAM is enough for SafeLine + a lightweight web app. For WordPress with MySQL, 2 GB is safer.
What's the catch?
No managed support. If something breaks, you fix it or wait for the Discord community to respond. For most small businesses, this is a fair trade for $0/month.
Related reads:
What's your current security setup — just hoping nobody finds your site?
#webdev #security #devops #tutorial