Security
Security from day one, with nothing to set up
Your sites and servers sit behind several layers of protection that work automatically. There's nothing to install or configure.
Security
Every site behind a web application firewall (WAF)
Requests that look like attacks — injection into your database, running commands on the server, reading server files — are checked before they reach your app. During a new site's first week they are only logged, so real visitors are never refused by mistake; then they are refused automatically.
Automatic, smart blocking of attackers
An address that scans or attacks is blocked automatically, and for longer if it comes back. Your real users are released automatically after a short time, and you can let an address back onto your own sites yourself.
A worldwide list of malicious addresses
Many addresses known around the world as attackers are turned away before their first request.
Round-the-clock monitoring and alerts
Security events are monitored automatically day and night, and serious ones alert our team at once. You see them in your own panel too.
SSH by key only, protected against password guessing
Servers are handed over with SSH sign-in by key only (no password). Addresses that keep guessing passwords are slowed and blocked, and if password sign-in is later turned on for a server, we tell you.
A private, isolated network for every customer
Each customer's servers sit on their own private network; other customers can't reach them, and only the ports you open are reachable from outside.
Automatic HTTPS for every domain
Every domain's SSL certificate is obtained and renewed automatically, and redirecting HTTP to HTTPS is one switch in the panel.
All of it in your panel
You see the firewall's status, refused requests and banned addresses in plain words in your own panel.
How does it work?
- A visitor's request reaches our edge first.
- Known malicious addresses and banned attackers are turned away right there.
- The web application firewall checks what the request carries.
- Most malicious requests are turned away right there; the rest reach your app over HTTPS.
To be clear
These layers stop most common web attacks and password guessing, but no service replaces keeping your app updated, strong passwords and backups. Against very large volumetric attacks we recommend a Cloudflare or ArvanCloud proxy in front of the domain, and we work with both.