01Layer 7
E-commerce & checkout
Carts and payment flows stay reachable during a flood. Per-route rules and rate limits slow scrapers and card-testing at checkout, and the cache absorbs traffic that never needed your origin.
DDoS protection · WAF · CDN: Stay online.
Even under attack.
GuardX puts its own edge in front of your websites and APIs — mitigation, firewall and delivery in one platform, built in-house and operated in the EU.
- No surcharge during attacks
- Set up in minutes
- Operated in the EU
- L3–L7
- Network to application, for every site behind the edge
- €0
- Surcharge when an attack hits
- <5 min
- To set up, live once your nameservers update
- 24/7
- Always on, nothing to activate
Built on open standards
- TLS 1.3
- HTTP/2
- HSTS
- DNSSEC
- GDPR DPA included
- Operated in the EU
01Platform
One edge. Every layer.
Mitigation, firewall, delivery, DNS and certificates run as one system in front of your stack — configured from a single control plane.
DDoS mitigation
Volumetric and application-layer floods are absorbed before they reach your origin. Always on, unmetered, and unnoticed by almost everyone using your product.
- 01Network floodsVolumetric and protocol attacks at layers 3 and 4, for every site behind the edge
- 02Application floodsHTTP floods and abusive bots at layer 7
- 03No surchargeAttack traffic is never billed, on any plan
Web application firewall
Managed protection out of the box, plus your own rules on path, header, country, network or rate.
- if path starts with /adminChallenge
- if rate > 20/min on /api/loginBlock
- if path matches /wp-login.phpBlock
Edge cache
Static content is served from the edge, so your origin only does the work that is actually new.
HTTP/2 200 x-guardx-cache: HIT age: 1832 cache-control: public, max-age=86400
Authoritative DNS
Records, DNSSEC and one-click proxying, managed in the panel.
- A@Proxied
- CNAMEwwwProxied
- MX@DNS only
TLS everywhere
Certificates issued and renewed automatically. TLS 1.3 by default, HSTS with one switch.
example.comTLS 1.3
Auto-renew on61 days left
02Under attack
When an attack starts, your visitors barely notice.
No rerouting, no DNS switch, no emergency call. Protection is already in the path — and the invoice does not move with the size of the flood.
01
Always on
Mitigation runs on every request, from the first one. There is nothing to activate when it matters.
02
Precise by design
Real users keep their sessions in almost every case. Interrupting a person is the last resort, not the default response.
03
Flat pricing
Attack traffic is never billed. Mitigation is part of every plan, including the free one.
03Products
Protection for everything you run.
Websites and APIs at layer 7 today. Whole networks at layers 3 and 4, and hardware behind the filter, are on the way.
- CDN & WAFLayer 7Reverse proxy, firewall, edge cache and bot protection for websites and APIs.Livefrom€0/ moLivefrom €0 / mo
- DDoS ProtectionLayer 3 – 7Unmetered mitigation for every site behind the edge, with no surcharge when an attack hits.Livefrom€0/ moLivefrom €0 / mo
- GRE TransitLayer 3/4Keep your own hardware and route whole prefixes through our network, any protocol.SoonPricing at launchSoonPricing at launch
- Ryzen VPSComputeRyzen cores on NVMe, inside the protected network from the first packet.SoonPricing at launchSoonPricing at launch
- Dedicated ServersBare metalThe whole machine, single-tenant and behind the filter.SoonPricing at launchSoonPricing at launch
04Use cases
Built for whatever you put behind it.
The same platform protects a checkout, a login endpoint and, soon, a game server — what changes is which layer does the work.
02Layer 7
SaaS & APIs
Machine traffic is your product, so protection is built to keep it flowing. Per-route rules and rate limits protect a login without touching the endpoints your customers automate.
03Layer 3/4
Gaming & voice
Coming soon: traffic routed to us over GRE, cleaned and handed back, so UDP floods never reach the box and your server address stays out of view.
04Layer 3 – 7
Agencies & hosting
A portfolio of client sites under one account, with per-domain rules and analytics, and pricing that does not move when a client is attacked.
05Network
European by design.
GuardX builds and runs its own platform. Our own engine inspects and caches your traffic on our own servers in the EU, and request logs are stored in the EU — no white-label firewall.
- Operated in the EU
- GDPR DPA built into our terms
- Own engine, no white-label firewall
- TLS 1.3, HSTS and DNSSEC
LocationsLivePlanned
- AMSNetherlandsLive
- FRAFrankfurtPlanned
06Getting started
Protected in three steps.
No agent to install, no library to import, no code to change.
01~2 minutes
Add your domain
We pick up your main DNS records, and you can paste a zone file for the rest. Nothing changes for visitors while you review them.
02Automatic
Switch nameservers
Point your registrar at GuardX. Certificates are issued automatically and traffic starts flowing through the edge.
03Optional
Tune if you want to
Sensible protection is active from the first request. Add rules, limits or a stricter mode whenever you need them.
07Learning centre
Understand it before you buy it.
Protection
What is a WAF (Web Application Firewall)?
A web application firewall inspects HTTP requests and blocks SQL injection, XSS and bot abuse before they reach your app. How it works and what it misses.
Attacks & threats
What is a DDoS attack?
A DDoS attack floods a target from many machines at once until it stops serving real users. Attack types, warning signs, real-world scale and defences.
Protection
What is DDoS mitigation?
DDoS mitigation filters attack traffic while real users keep getting through. Detection, techniques compared, always-on vs on-demand, pricing and set-up.
No. Mitigation is part of every plan, including the free one. An attack does not generate a bill — that is the whole point of a flat protection product.
Layer 7 is for websites and APIs: you point your DNS at us and every HTTP request passes through the edge. Layer 3/4, coming soon, is for everything else — game servers, mail, VPN, custom protocols — with traffic routed to us over a GRE tunnel and cleaned before it reaches your machine.
No. With Layer 7 you only change your nameservers. GRE transit, once it launches, leaves your hardware exactly where it is, and renting a server from us will be an option, not a requirement.
That is what we optimise hardest against. On a quiet day real visitors are almost never checked; during an attack, interrupting a person stays the exception, and a brief automatic check usually comes before anything stricter.
The network runs from the Netherlands today. Further locations are planned and marked as such on this page, never announced as live before they are.
The Layer 7 platform is live and handling real attack traffic. GRE transit for your own networks and servers you can rent from us are still to come — where something is not shipping yet, it says so.
Get started
Put GuardX in front
of what matters.
Most sites are set up in minutes, with zero code changes.
