Layer 7 · WAF & CDN: One proxy in front of everything.
Firewall and cache in the same hop.
Your traffic passes through our edge, running a firewall engine we built ourselves. It checks every request against our managed protections and your own rules, serves what can be cached from the edge, and forwards only what actually needs your origin — firewall and cache in a single hop.
- In-house
- Engine
- Managed + custom
- Rulesets
- 1.3, automatic
- TLS
- Edge, per path
- Cache
01What you get
Everything in one proxy
Firewall, cache and TLS in the same hop your traffic already takes, with DNS included.
Managed protection
Known attack tools, vulnerability scanners, exploit probes and path-traversal attempts are stopped by rules we maintain and update, without you deploying anything.
Custom rules
Match on path, method, header, query, country, ASN, fingerprint or rate — then allow, challenge, rate limit or block. Built in the panel or by API, live within seconds.
Edge cache
Static assets served from our edge cache, with simultaneous misses for the same file collapsed into one origin request instead of a stampede.
Compression
Text, scripts and styles compressed at the edge on the way out, so pages arrive lighter without any work on your origin.
TLS everywhere
Free certificates that renew themselves, TLS 1.3, HSTS when you want it, and encrypted, certificate-checked connections to your origin with one setting.
DNS included
Authoritative DNS with changes live on our nameservers at once. Manage records in the panel or by API, and proxy any A record with one toggle.
02Layer 7 · WAF & CDN
Rules you can actually reason about.
A rule is only as good as what it is built on. Each entry in the live log shows where the request came from, what it asked for and what it claimed to be — so you build rules from what actually happened on your site rather than from guesswork.
- 01Every event shows the request behind it
- 02Search recent blocks and challenges by IP or path
- 03Pause any rule without deleting it
- 04Rules and analytics kept per domain
03Layer 7 · WAF & CDN
Built so automation keeps working.
APIs, webhooks and integrations are traffic your business depends on, and a firewall that breaks them is worse than no firewall. We recognise your API endpoints automatically and you set the limits that suit each route, so integrations meet rate limits rather than browser checks, while abuse aimed at those same routes is still stopped.
- 01Rate limits set per route, by you
- 02API endpoints get rate limits, not browser checks
- 03Verified crawlers pass without a challenge
- 04Cache rules per path, not one global setting
05Further reading
The concepts behind this.
What is a WAF (Web Application Firewall)?
A web application firewall inspects HTTP requests and blocks SQL injection, XSS and bot abuse before they reach your app. How it works and what it misses.
What is a reverse proxy?
A reverse proxy accepts requests for your servers and decides what to forward. How it differs from a forward proxy and why CDNs and WAFs are built on it.
WordPress WAF: plugin vs cloud firewall
Plugin firewalls run in PHP after a request reaches you; cloud WAFs block it first. What each stops, tested nginx rules, and how to close origin bypass.
What is rate limiting?
Rate limiting caps how many requests a client may make in a period. The main algorithms, what to key on, an nginx example and the right 429 response.
Get started
Put it in front of your site today.
Free plan, no credit card, no code changes.
