Posts by Lia
@Lia
Lia Cornett
Homelab operator. Security tools. Self-hosted everything. Open source.
Posts by Lia
Before I turn protection on for a live site, I walk a decision checklist. The step I no longer skip is the management listener. Learning how to change the WAF web console listening port belongs in that checklist, because the console is where I will l...
I do not turn protection on in the same hour I install a web application firewall. SafeLine sits in front of the origin as a reverse proxy, so a rushed cutover can lock operators out of the console or send visitors to the wrong upstream. The product ...
A one-line installer is useful only when the host underneath it already matches the product's documented requirements. SafeLine's English deploy guide marks automatic installation as the recommended path, and that path is the official Linux manager s...
SafeLine is a self-hosted web application firewall that filters and monitors HTTP traffic between a web application and the Internet, and it works as a reverse proxy that cleans malicious traffic before it reaches the origin server https://docs.waf.c...
Protecting a Flask or Django application with a WAF is a placement decision, not a framework-plugin decision. The SafeLine introduction describes a self-hosted web application firewall that filters and monitors HTTP traffic between a web application ...
A keyword that asks for features, pricing, and a verdict is easy to overfill. This review uses a capability ledger instead. Every product claim below is tied to the official introduction, the deploy guide, or the application guide. If a line is missi...
Automatic HTTPS sounds simple until a reverse-proxy WAF sits on the public address. Let's Encrypt can renew a certificate, but the supplied SafeLine documentation does not describe an ACME client, a certificate upload workflow, or an automatic renewa...
A CDN and a WAF can sit on the same request path, but only one of those roles is described in the SafeLine guides supplied for this article. SafeLine is a self-hosted web application firewall that filters and monitors HTTP traffic between an applicat...
The PHP Core rule SafeLine shipped on 21 October is not a generic "block all uploads" switch. It is aimed at request features from the known chain behind CVE-2026-109618 and CVE-2026-109619.
Four signs are called out in the rule note. A request that...
File upload is the practical entry for CVE-2026-109618. The weakness is in PHP's handling of multipart/form-data and the memory state around that parse, not in a single shopping-cart plugin.
An attacker does not need a valid image. They need a reque...
People who search for how to whitelist an IP in SafeLine WAF usually expect a short console path. The pages used for this article do not document that path. They do not list an allow field, a match expression, or a command that exempts one address fr...
Rate limiting looks like a settings page problem, but the useful work happens before any limit is enforced. A web application firewall sits in front of the origin and decides which HTTP traffic is allowed to continue. SafeLine describes that role as ...
A console login only proves that the management service answered. It does not prove that public clients are being filtered. SafeLine is a self-hosted web application firewall placed in front of a web application so that it can filter and monitor HTTP...
A false positive is not one event. On a reverse-proxy web application firewall, a blocking page, a captcha, a password prompt, and a throttled client can all look the same to the person who filed the ticket. Reducing false positives starts by naming ...
A homelab rarely fails in one dramatic way. It fails when a useful web app is reachable, a password form is guessable, and nobody has decided which requests are allowed to touch the origin. A WAF can help, but only if you treat it as a reverse proxy ...
An online store is still a web application. Catalog search, account login, cart updates, and the staff console all arrive as HTTP or HTTPS requests. A web application firewall does not replace server-side validation, payment-provider controls, or car...
A Next.js app is still a web application that speaks HTTP. That is the only placement fact you need before you look for a framework plugin. The SafeLine documents used here do not describe a Next.js SDK, App Router hook, or hosting-platform add-on. T...
Protecting a Node.js app with SafeLine starts as a fit decision, not as a search for an in-process library. The product documents describe SafeLine as a self-hosted web application firewall that filters and monitors HTTP traffic between a web applica...
A Laravel app does not become protected just because a firewall product exists. The useful question is where the control sits, what traffic it can see, and how you prove the origin still works after the cutover. This guide is a decision checklist for...
chevron_left