Data plane
Inline block
Parameters are decoded and parsed. Deterministic exploits stop immediately.
REQUEST CONTROL PLANE
Inspect the request, then choose the action. Confirmed attacks stop at the edge; uncertain samples enter a background queue.
Apache-2.0 Self-hosted Uncertain samples reviewed async
CheeseWAF / control-plane / overviewLIVE · 14:32:08
Window requests12,842last 15 min
Window blocks1841.4%
Average response time0.4msaverage
Protected sites3enabled
Traffic totalsRequest trend
Recent security eventslast 60s
TimeEventAction
14:31:52SQL injection · /api/usersBLOCK
14:31:37Bot challenge · /loginREVIEW
14:30:58Normal request · /dashboardPASS
14:30:44Path traversal · /filesBLOCK
14:30:41Rate limit · /api/searchREVIEW
02Capabilities
Block first. Review after.
Handle confirmed attacks in the request path. Send uncertain samples to the queue.
03START IN MINUTES
Choose your way to run it
Pick the install path that fits your setup. Each one uses the same configuration and console.
01
One-line install
Linux installer pulls the latest release and prints public + private entry points.
Read the docs02
Container
Run the same binary with your own volumes, secrets, and reverse proxy.
Read the docs03
Build from source
Use Go and the web console when you need a fully local toolchain.
Read the docs04Comparison
Why CheeseWAF
Rules, syntax checks, and async review each do one job. The model only sees ambiguous samples.
| Dimension | Regex WAF | Sync LLM WAF | Heavy Container Stack | Commercial Cloud WAF | CheeseWAF |
|---|---|---|---|---|---|
| Detection | Regex pattern matching | Sync LLM per request | Regex + statistical analysis | Rule sets + threat feed | AST syntax analysis + Async ALAP |
| Inline Latency | 1–10 ms | 500–2000 ms (high) | 2–15 ms | Dependent on CDN routing | < 1 ms (sub-millisecond, zero wait) |
| Token Cost | None | Extremely high (all traffic) | None | Bandwidth & tier pricing | Low (only reviews ambiguous samples) |
| Evasion / FPR | Easily bypassed by encodings | Prone to hallucinations | Complex rule maintenance | Vendor-dependent updates | Parses syntax trees; immune to obfuscation |
| Footprint | Requires compiling Nginx | External API dependency | 5–10 containers, 1–2 GB+ RAM | Commercial cloud only | Single binary, tens of MB RAM |
| Data Privacy | Local | Full traffic sent to external API | Local | Traverses public cloud | 100% on-premises; optional private LLM |
05Path
How a request moves
The first five steps finish before the response. ALAP handles uncertain samples after it returns.
INLINE PATH0.4 ms · response first
01
Ingress
HTTP, HTTPS, and HTTP/3.
02
Filter
IP, geo, and client soft fingerprints.
03
Bots and limits
CAPTCHA, token buckets, waiting rooms.
04
Rules & semantics
Custom rules short-circuit first; AST engine parses deep.
05
Origin
Clean and queued traffic still go upstream.
response returned
AFTER RESPONSE · ASYNC REVIEW
06
ALAP
Samples go to the configured OpenAI- or Anthropic-compatible provider.
07START HERE
You hold the keys. AI keeps the cheese.
Connect one site, watch the decisions, then tune the rules you actually need.