Free, open-source alternatives to Cloudflare WAF
Web application firewall in front of your site. 3 apps you can run yourself instead of Cloudflare WAF, sorted by how well they replace it. Each one is open source, so your data stays with you.
SafeLineBest match
Web application firewall / reverse proxy to protect your web apps from attacks and exploits.
BunkerWeb
Next-gen Web Application Firewall (WAF) that will protect your web services.
UUSEC WAF
Industry-leading high-performance, AI and semantic technology web application firewall and API security gateway (fork of nginx).
Side by side
Why replace Cloudflare WAF?
Cloudflare WAF works, but your data lives in someone else's account, the price can change at any time, and features can disappear. An open-source app you run yourself is yours: you choose where it runs, who can see the data, and when to update.
Questions
What is the best free alternative to Cloudflare WAF?
SafeLine is the closest open-source replacement for Cloudflare WAF in our list. BunkerWeb and UUSEC WAF are worth a look too, depending on what you need.
Can I self-host an alternative to Cloudflare WAF?
Yes. All 3 apps on this page are open source and can run on your own server, usually with Docker, or on a managed host that installs them for you.