WAFio protects your web applications and servers with multi-layer security that runs entirely on your infrastructure. No third-party cloud, no subscription fees, no vendor dependency — just full control over your security stack, deployed in minutes.
Explore the threat simulatorEXPLORE THE DEFENSE PATH
Switch between network, application, and runtime scenarios. Follow the signal through each layer and see how different controls respond.
GET /api/users?id=1' UNION SELECT username, password_hash FROM admin--TCP traffic passes the configured network rules.
PASSSQL injection signals exceed the example block threshold.
BLOCK 403The rejected request does not reach application code.
STANDBYIllustrative scenarios, not live traffic or performance measurements. Real results depend on policy, payload, database coverage, and deployment.
FROM TERMINAL TO PROTECTION
Start with a single server or deploy the control plane, WAF agents, and host agents separately. Choose a component to get its installation command.
curl -fsSL https://wafio.cloud/install.sh | sudo bashReview prerequisites and installer options in the installation guide ↗.
*Latency is a design target, not a benchmark guarantee. Measure with your policies and traffic.
BUILT FOR PEOPLE WHO OWN THEIR STACK
Whether you operate client applications, investigate attacks, or keep production running, WAFio brings security controls into your own environment.
Manage protection for multiple clients without putting every application in the same project. Deploy WAFio alongside client workloads and use one control plane to coordinate access, configuration, and agents.
Work with semantic inspection, OWASP CRS, upload hash verification, and kernel telemetry in one platform. Investigate the evidence behind a decision and tune sensitivity to the application you are protecting.
Deploy the control plane and agents with the installer, manage services through systemd, and distribute configuration over gRPC. Run on supported Linux servers, virtual machines, or bare metal without requiring a Kubernetes operator.
ONE PLATFORM. A BROADER VIEW.
Bring application, upload, network, and host security together. Configure centrally. Enforce where your workloads run.
Semantic analysis and OWASP CRS help identify malicious HTTP requests. Set enforcement policies for the needs of each application.
Explore Semantic WAFInspect complete files locally. Confirm malware hash matches with exact SHA-256 verification, and choose how incomplete scans are handled.
Explore Malicious Uploads DetectionApply network rules with Linux XDP and TC. Manage IP policies and observe enforcement alongside your application security events.
Explore eBPF FirewallTrace host activity, enrich events with container context, and apply detection rules to investigate suspicious process behavior.
Explore Runtime SecurityFEATURE SPOTLIGHT / FILE UPLOADS
Check files against malware hashes without sending the uploaded content to an external analysis service.
The WAF agent hashes complete files within your configured scan budget.
Bloom candidates require an exact SHA-256 match before a malware verdict.
Block confirmed matches or log them. Choose whether incomplete scans should continue.
Know the scope: unknown or modified malware may not match. Archives are not unpacked. A missing feed can leave only the EICAR test signature available.
INTERACTIVE POLICY EXAMPLE
Block mode rejects the upload after an exact SHA-256 match, not a Bloom candidate alone.
Other WAF rules and application validation still apply.YOUR STACK. YOUR CONTROL.
Keep inspection close to your applications. Use the control plane to manage agents, distribute configuration, and investigate security events.
Define project policies, manage access, and connect threat intelligence providers from one dashboard.
Explore the dashboardProvision client certificates and deliver configuration over gRPC with mutual TLS.
Connect your agentsWAF agents inspect requests. Linux host agents enforce network policy and report runtime activity.
Read the architecture
HOW IT WORKS / THREE SECURITY LAYERS
Network filtering, HTTP inspection, and host tracing address different signals. Follow each pipeline from observation to its policy response.
Apply packet policy close to the network interface, before allowed traffic continues toward application inspection.
Read the technical guide ↗The XDP program inspects inbound packets at its attachment point. Native driver mode can act before the normal socket-buffer path; attachment mode and driver support determine exactly where the program runs.
The program consults kernel maps for configured address, protocol, port, and rate policies. The host agent receives control-plane configuration and updates the enforcement maps, keeping packet decisions local to the host.
Matching deny rules can produce XDP_DROP. Allowed traffic continues with XDP_PASS through the network stack. TC hooks provide additional traffic-control attachment points for network enforcement.
Inspect HTTP requests in the reverse proxy and apply the policy for the application behind it.
Read the technical guide ↗Route application traffic through the WAF agent. The reverse proxy applies body limits, flood controls, block policies, geoblocking, bot checks, and configured path rules before later inspection stages. Your application does not need a language-specific SDK.
Semantic engines inspect attack structures across SQL, XSS, commands, PHP, Python, LFI, SSRF, Java, LDAP, NoSQL, prototype pollution, SSTI, XXE, deserialization, redirects, prompt injection, header injection, GraphQL abuse, JWT header attacks, and anomalies. Coraza/OWASP CRS adds rule-based signals; configured clean-result suppression controls unnecessary CRS scoring. Upload scanning separately verifies complete-file hashes.
The decision engine evaluates eligible rule signals, sensitivity, and configured thresholds to allow, log, or block. Confirmed malware hash matches use the upload policy. Incomplete scanning has its own forwarding or rejection policy, so it is not confused with a malware verdict.
Observe activity inside a running host, including behavior that cannot be understood from HTTP requests alone.
Read the technical guide ↗Supported eBPF kprobes and tracepoints capture process, file, and network activity such as execve, openat, and connect. Coverage depends on the attached programs, kernel capabilities, and configured trace settings.
Process identifiers, parent context, user information, paths, and container attribution help explain what happened. The control plane evaluates detection rules that can suppress, escalate, downgrade, or tag events for investigation.
Review runtime events in the dashboard and choose a supported enforcement mode for the host policy. Monitor and simulation help validate a rollout; enforcement may terminate a matching process. Responses and timing depend on the selected rule and mechanism.
KERNEL-LEVEL PROTECTION
Two eBPF subsystems provide different views: packets at the network layer and activity inside running processes. Investigate both alongside application events.
Use XDP and TC to enforce network rules in the Linux kernel. Keep address policies, rate controls, and enforcement visibility connected to the control plane.
Inspect packets at the network interface. Native XDP allows early drops where supported; deployment mode and driver capabilities matter.
Maintain enforcement data in kernel maps and apply configuration received by the host agent. Review policy state and events from the dashboard.
Manage address allow/block rules alongside protocol, port, geolocation, and supported rate policies. Tune scope to the services running on each host.
Observe and apply supported network policies at traffic-control attachment points, complementing inbound XDP filtering.
Correlate process execution, file access, and connections with the workload that produced them. Use trace evidence to investigate suspicious activity.
Follow supported kernel events such as process execution and connection attempts. Use detection rules to highlight behavior worth investigating.
Review supported file operations and paths to investigate sensitive configuration changes, suspicious writes, or unexpected file access.
Understand parent-child process relationships, executable names, user context, and available event attributes. Identify unusual descendants of application workers.
Enrich events with available container identifiers and images. Docker/containerd integration supplies workload context and degrades gracefully when the runtime socket is unavailable.
SELF-HOSTED BY DESIGN
Deploy the WAF agent alongside your applications and keep traffic inspection on infrastructure you manage. Connect network and runtime visibility through a central control plane.
WAFioYOUR APPLICATIONS · YOUR INFRASTRUCTURE
LIVE DEMO
Visit the demo environment to explore an OWASP Juice Shop application and the WAFio control plane. Use the demo guide for access details and the available test scenarios.
Explore the intentionally vulnerable application behind the demo WAF. Use the guide to understand how request inspection and policy enforcement appear from the application side.
Open demo application ↗Review the interface, agents, and security decisions from the dashboard. The demo guide explains the provided access and how to explore the environment.
Open demo dashboard ↗FREE SOFTWARE. YOUR INFRASTRUCTURE.
WAFio is free to download and self-host for personal and commercial use. Deploy the software on infrastructure you own or control.
No signup. No credit card. No license key.
Reselling or redistributing the software as a standalone product is not permitted. Read the terms of use ↗
BUILD WITH CONFIDENCE
Start with the installation guide. Connect your agents.
Put your own policies into practice.