If your team already runs an identity provider, the last thing you want is a second login system. You want your apps to trust the identity system you already have — whether that's Keycloak, Auth0, Okta, or Azure AD. OpenID Connect OIDC is the protoco...

"Sign in with GitHub" is one of the first things developers reach for when an internal tool needs authentication. The usual route is a real engineering task: register a GitHub OAuth app, add an OAuth client library to your codebase, store the ClientI...

Most people treat authentication as an application problem. If an internal dashboard, an admin panel, or a legacy tool doesn't have a login screen, the reflex is to open the codebase and start wiring up an auth library — OAuth clients, session manage...

The Multi-Site Use Case You run a VPS with 3 sites: a WordPress blog on blog.example.com, a SaaS app on app.example.com, and a static landing page on example.com. You want one WAF to protect all three — no per-site overhead. Adding Multiple Sites ...

Database Injection Is Still the Number One Threat OWASP Top 10 hasn't changed. Database injection remains the most dangerous web vulnerability and the most common one. In 2025, about 23% of all reported web vulnerabilities were injection flaws. Wh...

The Situation You already have a Docker Compose stack running: Nginx + your app + PostgreSQL + Redis. It works. You don't want to rebuild it. But you want WAF protection in front. Here's how to add SafeLine to an existing Docker Compose project wi...

The Dashboard Isn't Just Numbers Your WAF blocks attacks. The Attack Logs tell you what those attacks were, where they came from, and whether any got through. Reading these logs turns random blocks into actionable intelligence. Anatomy of an Attac...

The $5 Challenge Can you run a production-grade WAF on the cheapest VPS available? I tested it on a $5/month VPS 1 vCPU, 1 GB RAM, 25 GB SSD from a major provider. The goal: protect a Node.js blog and a static site without exceeding the budget. Th...

Good Bots vs Bad Bots Not all bots are created equal. | Bots You Want | Bots You Don't Want | |---|---| | Googlebot — indexes your site for search | Scrapers — steal your content | | Bingbot — same as Google, different engine | Credential stuffers...

The Dashboard Isn't Just Numbers Your WAF blocks attacks. The Attack Logs tell you what those attacks were, where they came from, and whether any got through. Reading these logs turns random blocks into actionable intelligence. Anatomy of an Attac...

The $5 Challenge Can you run a production-grade WAF on the cheapest VPS available? I tested it on a $5/month VPS 1 vCPU, 1 GB RAM, 25 GB SSD from a major provider. The goal: protect a Node.js blog and a static site without exceeding the budget. Th...

Why Geo-Block? Not every country needs to reach your server. If you run a local business in Brazil, you don't need traffic from North Korea. If you serve customers in the EU, you probably don't need visitors from 150 other countries hitting your lo...

The Setup Deployed SafeLine Community Edition on a $10/month VPS in front of 3 small websites: a WordPress blog, a Node.js SaaS app, and a static portfolio. Let it run for 30 days, blocking nothing — pure observation mode. Here's what showed up. D...

The Problem Your login page, search endpoint, or contact form is getting hammered. Rate limiting is the fix — but implementing it in application code means finding every endpoint, writing middleware, choosing a storage backend, and deploying change...

Why APIs Need Different Protection Web form attacks SQLi, XSS target HTML endpoints. API attacks are different — they exploit JSON bodies, GraphQL queries, auth tokens, and rate limits. Your API needs protection that understands these attack vector...

Week 1: The Scanner Flood Within 24 hours of going live, the WAF started blocking automated scanners. Not targeted attacks — just internet background radiation hitting anything with a public IP. Week 1 stats: Total requests inspected: ~180,000 B...

What I Tested | Factor | Setup | |---|---| | Server | 2 vCPU, 2 GB RAM VPS | | Stack | Nginx -> SafeLine Docker -> Node.js app | | Tool | Apache Bench, wrk, curl timing | | Baseline | Direct to Node.js app no WAF | | WAF mode | SafeLine Community, ...

Before You Start Make sure Docker is installed docker --version # Should be 20.10.6+ docker compose version # Should be 2.0.0+ Make sure you have room df -h / # Need at least 5 GB free free -h # Nee...

| | Plugin WAF Wordfence, etc. | Reverse Proxy WAF SafeLine | |---|---|---| | When it loads | After WordPress boots | Before traffic hits WordPress | | Database hit per blocked request | Yes — WordPress and MySQL already queried | No — blocked at the...

| WAF | Type | Deployment | |---|---|---| | SafeLine Community | Self-hosted, reverse proxy | Docker, one command | | Cloudflare Free | Cloud-based, edge proxy | DNS change | | CrowdSec WAF | Self-hosted, module-based | Nginx/HAProxy plugin | | ModSe...