The WAF that tells you what's safe to block.
Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
One DNS change — or we do DNS. Promote Copilot reads your count window and explains what's safe to promote — you still click once.
Start a 14-day trial · $150/site/mo
Card at Stripe checkout. Cancel before the 14-day trial ends and you won't be charged.
Promote Copilot
Promote Copilot reads your count window and explains what's safe to promote — you still click once.
Set up & tuned for you
We provision, configure, and tune the shield. Or request concierge setup and we do the DNS too.
Full managed WAF
SQL injection, XSS, exploits, bots, IP reputation, account-fraud protection — we turn them on and tune them.
Free auto SSL
A free TLS certificate is issued and renewed for you. Visitors get HTTPS automatically.
Human support
A specialist is one message away — rule tuning, spike reviews, shield health.
Custom rules
Block by country or IP, allow-list trusted clients, rate-limit abuse — next to managed rules.
Protected in three steps
We stand up the shield. You point DNS — or we do.
Add your site
Domain and origin. We stand up the edge and issue SSL.
Point DNS — or we do
Subdomain: one CNAME. Apex: delegate nameservers once. Concierge if you'd rather not touch DNS.
Count, then promote
Rules start in count. After 24 hours, your dashboard shows what's safe to block — one click.
Managed rules, custom IP/geo/rate rules, account-fraud protection, Promote Copilot, free SSL, Slack/email spike alerts, live dashboard. 14-day trial.
Start a 14-day trialCard at Stripe checkout. Cancel before the trial ends and you won't be charged.
Who this is for
Campus, public-sector, and web teams with too many sites.
Campuses
Enrollment, athletics, news, and departmental sites that need a shield without another console for IT to run.
Public agencies
Public-facing sites where downtime and defacement are not an option. We run the shield; your team keeps the site.
Web teams with too many sites
Too many domains, not enough people to babysit a firewall. Add a site, point DNS, see what's blocked.
Questions, answered
Do I have to move my website?
No. We sit in front of your existing site via DNS — your server, hosting, and code stay exactly where they are.
Will it slow my site down?
No noticeable impact. Traffic runs through a global edge, milliseconds from visitors. Clean requests pass straight through to your origin.
What if a rule blocks a real customer?
New protections start in count for 24 hours — they watch without blocking — then you promote to block. Promote Copilot explains the count window; you still click once. It never auto-blocks. You're always in control per rule. See what a branded 403 looks like.
Can I keep my own DNS provider?
Yes. CNAME mode keeps your provider. Or pick managed DNS, delegate nameservers once, and we handle SSL and routing.
Is my traffic data private?
Authorization and cookie headers are redacted before anything is logged. We keep what's needed for blocked attacks and traffic stats.
What if my site gets a lot of traffic?
300 GB and 5 million requests a month included. Extra traffic is $0.15/GB and $3 per million requests. You see live usage; we email before overage adds up.
Can I cancel anytime?
Yes — month to month, $150 per protected site. Remove a site and billing follows.
Can I get Slack or webhook alerts?
Yes. Email is on by default. Add a Slack incoming webhook or any HTTPS webhook on the Alerts page.
Do you have an uptime SLA?
Yes — 99.9% monthly edge availability for Live sites, with service credits if we miss it. Origin downtime, DNS/registrar mistakes, and regional edge outages are excluded. Details on the SLA.
What engine sits in front of the site?
AWS WAF on CloudFront. We provision and tune it; you change DNS — or we do.
$150/site/mo · 14-day trial