Hacking is stopped before it reaches your site
The WAF checks every request and blocks hacking attempts. No changes to your site code.
GET /catalog?page=2AllowedGET /search?q=1' OR '1'='1Blocked: SQL injectionGET /.envBlocked: ScannerPOST /loginAllowedPOST /login ×40Blocked: Password guessing
What it protects against
Attacks through forms and URLs
SQL injection, XSS and other known attacks are blocked from day one.
Scanners
Searches for admin panels, backups and config files find nothing.
Password guessing
Repeated login attempts are slowed down, then blocked. You can open your admin panel to your own addresses only.
Your own rules
Block or allow requests by page, country, address and other conditions.
See what was blocked and why
- The rule, page and address for every block.
- An exception for a page or address in two clicks.
- A history of rule changes.
Common questions
Setup, DNS, SSL and account questions are answered in Help.
Will it work with my site?
Yes. The WAF sits in front of your site, so the platform does not matter: WordPress, Drupal, Laravel or your own code.
What if it blocks a request I need?
You will see it in your dashboard and can add an exception for that page or address.
Are custom rules in the free plan?
Built-in protection and access rules are in every plan. Custom WAF rules start with Pro.
Your first site is free
Sign up, add your domain and change one DNS record.