Help with the dashboard

Open my.aegisx.network/register and enter your email, a password and, if you like, your name and company. The account is created on the Free plan and you are signed in right away.

Go to Account, then Profile, and open Two-factor authentication. Scan the QR code with an authenticator app (Google Authenticator, 1Password, Authy and similar), enter the 6-digit code and save the recovery codes somewhere safe. From then on, sign-in asks for a code after your password.

Sign in with one of the recovery codes instead of the 6-digit code. Each recovery code works once. If you have none left, write to support from the email address of your account.

Write to support@aegisx.network from the email address of your account and we will help you get back in. If you are signed in, you can change the password in Account, Profile.

Your name is changed in Account, Profile. To change the email address of an account, contact support.

Open Sites and press Add site. Enter:

• the domain visitors use, for example shop.example.com
• the address of your server (the origin), for example 203.0.113.20:443, and whether it speaks http or https
• the protection level: Essential, Recommended or Under attack
• whether to issue an SSL certificate

You can change all of it later on the site page.

The server where your site actually runs. AegisX forwards allowed requests to it. It must have a public IP address or host name; private addresses such as 10.x.x.x or 192.168.x.x are not accepted. You can add more origins later and share traffic between them.

We check that the domain is yours before we serve it. The site page shows a TXT record with its name and value. Add it at your DNS provider and press Check now. We also check on our own every few minutes. A site that is not verified within 3 days is removed, and you can add it again.

Each plan has a number of sites. Remove a site you no longer need, or move to a larger plan. Your current limits are in Account, Plan & usage.

Yes. Add the subdomain, for example app.example.com, as its own site and point only that name to AegisX. The rest of the domain stays as it is.

When you add a site, and on the site page until the domain points to us, the dashboard shows the A records (and AAAA for IPv6) with our addresses. Set them for the domain and for www if you use it, and remove other A and AAAA records for the same names. Leave your MX and other records unchanged.

Usually a few minutes after you save the records. Some providers and old cached answers can take up to a few hours. The site page shows when the domain resolves to our addresses.

Yes. You only change the records. If the provider has its own proxy (an orange cloud at Cloudflare), turn it off for these records, otherwise traffic does not reach us directly.

Turn on HTTPS for the site. Once the domain points to AegisX, a free Let's Encrypt certificate is issued and renewed before it expires. The SSL/TLS tab of the site shows its status and expiry date. HTTP requests are redirected to HTTPS.

On Business and Enterprise plans, upload the certificate and its private key in the SSL/TLS tab of the site. The free certificate is used when none is uploaded.

Not necessarily. Choose http for the origin and we connect to it without TLS; visitors still get HTTPS. If your server has HTTPS, choose https and we connect securely.

• Essential: the firewall blocks attacks, with no rate limit and no browser check. For APIs and sites that sit behind another CDN.
• Recommended: firewall, a limit of 120 requests per minute per visitor and protection of login forms against password guessing.
• Under attack: all of the above plus a browser check for every new visitor. For the time of an attack.

On the site page press Under attack mode, choose how long it should stay on and confirm. Every new visitor goes through a short browser check; regular visitors pass it in a moment. On Pro and higher plans it also switches on by itself when a site gets a sudden flood.

The browser check runs in the background and most people never notice it. The picture captcha asks the visitor to solve a small puzzle and stops more automated tools, at the cost of a click. Pick one in Protection, Challenges. Only one is used at a time.

Go to Rules, IP access and add the address or range (for example 198.51.100.0/24), choose Block or Allow, the site or all your sites, and for how long. Allowed addresses skip checks, which is handy for your office or your monitoring.

Use Rules, Firewall rules. A rule matches on path, method, headers, cookies, query or client IP and then blocks or allows the request. For example: path starts with /admin and client IP is not one of your office addresses, then block.

Find the request in Request logs or Events: each blocked request shows the reason. Allow the visitor's IP in Rules, IP access, or relax the rule that matched. If it was a built-in rule, write to support with the time and the address and we will look at it.

No. Real search engine crawlers are recognised and let through. Bots that only pretend to be Google are blocked.

Overview shows requests and blocked traffic for all your sites. Events lists attacks and blocks as they happen, with the reason. Request logs show single requests and can be filtered by site, IP, path and status.

Free: 7 days. Pro: 14 days. Business: 30 days. Enterprise: 90 days.

Open the site, go to the Cache tab and press Purge. New versions of your files are fetched from the origin on the next request.

On Pro and higher plans, the Error pages tab of a site lets you replace the pages for blocked requests and for errors such as 502 or 504 when your server is down.

Go to Account, Team and add their email, a name and a password for them, and choose a role. Only the owner of the account can manage the team.

• Owner: everything, including the team.
• Admin: sites, rules and settings, but not the team.
• Viewer: sees everything, changes nothing.

Yes. The Audit log lists every change in the account with the person, the time and what was changed.

Account, Plan & usage shows the plan, its limits and how much of each you use, along with your traffic for the last 24 hours.

Write to support@aegisx.network from the account email and name the plan you want. The new limits apply as soon as the change is made.

No. The price of a plan is fixed. Traffic we block is not counted, and an attack does not change your bill.

On the site page, Pause stops serving the site through AegisX until you press Resume. The bin icon deletes the site and its settings. Before you pause or delete, point the domain back to your own server, or visitors will not reach it.

Point your domains back to your servers, then write to support from the account email. We delete the account and its data.