samwafgo/SamWaf

What is it?

Key features

• 01Detects SQL injection, XSS, RCE, path traversal and scanner traffic.
• 02Reverse proxy with weighted, IP-hash and least-connection load balancing.
• 03Automatic SSL certificate issuance and renewal via ACME.
• 04Encrypted local storage of logs and data, with SQLite by default.
• 05Geo blocking, IP and URL allow/block lists, and CC rate limiting.
• 06Log-only mode for tuning rules without blocking traffic.

Use cases

• Protecting a small company's website or API without relying on a cloud WAF service.
• Hosting personal or studio websites behind a self-managed firewall on Linux or Windows.
• Running a private WAF in an environment where traffic logs must stay on-premises.
• Trialing WAF rules in log-only mode before enforcing them in production.

Quick start

1. 1

   Download the latest release from the releases page

2. 2

   Run the Docker image

   docker run -d --name=samwaf-instance --restart always -p 26666:26666 -p 80:80 -p 443:443 -v /path/to/your/conf:/app/conf -v /path/to/your/data:/app/data -v /path/to/your/logs:/app/logs -v /path/to/your/ssl:/app/ssl samwaf/samwaf
3. 3

   Open http://127.0.0.1:26666 and log in as admin with the initial password

Things to know

• !Windows and Linux installs require admin or root privileges for service mode.
• !Initial password is stored in a file and must be changed on first login.

In collections

Topics

FAQ

What is SamWaf?

A lightweight, open-source web application firewall for small companies, studios and personal websites, deployable fully on-premises. SamWaf is a web application firewall that sits in front of websites and APIs to detect and block attacks such as SQL injection, XSS, remote command execution and path traversal. It also handles traffic routing, with reverse proxying, load balancing, health checks, static site serving and TCP/UDP tunnel forwarding, plus automatic SSL certificate issuance and renewal through ACME.

Is SamWaf free to use? What license does it have?

SamWaf is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is SamWaf still maintained?

Actively maintained. The last commit to SamWaf was on Oct 22, 2026.

What can I use SamWaf for?

Protecting a small company's website or API without relying on a cloud WAF service. Hosting personal or studio websites behind a self-managed firewall on Linux or Windows. Running a private WAF in an environment where traffic logs must stay on-premises. Trialing WAF rules in log-only mode before enforcing them in production.

How do I install SamWaf?

Download the latest release from the releases page Run the Docker image: docker run -d --name=samwaf-instance --restart always -p 26666:26666 -p 80:80 -p 443:443 -v /path/to/your/conf:/app/conf -v /path/to/your/data:/app/data -v /path/to/your/logs:/app/logs -v /path/to/your/ssl:/app/ssl samwaf/samwaf Open http://127.0.0.1:26666 and log in as admin with the initial password

Where can I get SamWaf?

The source code and installation instructions are on GitHub: https://github.com/samwafgo/SamWaf