The shield in front of your site. We run it.
We put a shield in front of your site. One DNS change — or we do DNS. Rules watch for 24 hours, then we tell you what's safe to block.
Start a 14-day trial · $150/site/mo
Set up & tuned for you
We provision, configure, and tune the shield. Or request concierge setup and we do the DNS too.
Full managed WAF
SQL injection, XSS, exploits, bots, IP reputation, account-fraud protection — we turn them on and tune them.
Free auto SSL
A free TLS certificate is issued and renewed for you. Visitors get HTTPS automatically.
Human support
A specialist is one message away — rule tuning, spike reviews, shield health.
Custom rules
Block by country or IP, allow-list trusted clients, rate-limit abuse — next to managed rules.
One screen
Traffic, blocked threats, count to block. One place to see the shield.
Protected in three steps
We stand up the shield. You point DNS — or we do.
Add your site
Domain and origin. We stand up the edge and issue SSL.
Point DNS — or we do
Subdomain: one CNAME. Apex: delegate nameservers once. Concierge if you'd rather not touch DNS.
Watch, then block
Rules start in count. After 24h we tell you what's safe to promote.
Managed rules, custom IP/geo/rate rules, account-fraud protection, free SSL, Slack/email spike alerts, live dashboard. 14-day trial. Founder offer: 50% off for 3 months.
Start a 14-day trialWho this is for
Experience protecting higher-ed and public-sector sites.
Campuses
Enrollment, athletics, news, and departmental sites that need a shield without another console for IT to run.
Public agencies
Public-facing sites where downtime and defacement are not an option. We run the shield; your team keeps the site.
Web teams with too many sites
Too many domains, not enough people to babysit a firewall. Add a site, point DNS, see what's blocked.
Questions, answered
Do I have to move my website?
No. We sit in front of your existing site via DNS — your server, hosting, and code stay exactly where they are.
Will it slow my site down?
No noticeable impact. Traffic runs through a global edge, milliseconds from visitors. Clean requests pass straight through to your origin.
What if a rule blocks a real customer?
New protections start in count for 24 hours — they watch without blocking — then you promote to block. You're always in control per rule.
Can I keep my own DNS provider?
Yes. CNAME mode keeps your provider. Or pick managed DNS, delegate nameservers once, and we handle SSL and routing.
Is my traffic data private?
Authorization and cookie headers are redacted before anything is logged. We keep what's needed for blocked attacks and traffic stats.
What if my site gets a lot of traffic?
300 GB and 5 million requests a month included. Extra traffic is $0.15/GB and $3 per million requests. You see live usage; we email before overage adds up.
Can I cancel anytime?
Yes — month to month, $150 per protected site. Remove a site and billing follows.
Can I get Slack or webhook alerts?
Yes. Email is on by default. Add a Slack incoming webhook or any HTTPS webhook on the Alerts page.
Do you have an uptime SLA?
Yes — 99.9% monthly edge availability for Live sites, with service credits if we miss it. Origin downtime, DNS/registrar mistakes, and regional edge outages are excluded. Details on the SLA.
What engine sits in front of the site?
AWS WAF on CloudFront. We provision and tune it; you change DNS — or we do.
$150/site/mo · 14-day trial