Keep bots out. Keep your site yours.
Bot and attack protection for small and mid sites, from our own edges in the US and Europe. No tracking of your visitors, no DNS move unless you want one, and search engines always welcome.
- Private by design: Only the visitor's IP, host, path, method, user agent and our own pass cookie reach the edge. Never your cookies, your Authorization header or your request bodies.
- No DNS move needed: Nine ways to connect without touching DNS: one include in your web server, a middleware, a WordPress plugin, a form widget or a log agent.
- Fails open: If both edges are slow or down, your site keeps serving. The check gives up after 300 ms per edge.
- Bots welcome: Google, Bing and the AI crawlers you want are never challenged or rate limited.
Ten ways to connect
- nginx: One include per server block (auth_request). Backup edge and fail open built in.
- Caddy: forward_auth with a small local relay for backup and fail open.
- Traefik: A forwardAuth middleware from the file provider.
- Apache: mod_rewrite with a small Python helper.
- Express / Node: app.use(osec({ region })) before your routes.
- FastAPI / ASGI: app.add_middleware(OsecMiddleware, region=...).
- WordPress: Plugin: human check on login, sign-up, comments, Contact Form 7.
- Forms only: A widget in the form and one verify call on your server.
- Log agent: Reads nginx and ssh logs, bans attackers, shares the ban list. Adds no time to requests.
- Full proxy: Point DNS at us: certificates, cache, caps and purge. EU edge for now.
What it does
- Challenge page: a short proof-of-work and browser check, no image puzzles, a pass cookie for 30 minutes
- Managed WAF rules: SQL injection, XSS, path traversal, command injection, scanners, bad user agents
- Block, log-only or off for the WAF; log-only for the whole site while you try it
- Bad-path blocking: .env, .git, SQL dumps, phpinfo and wp-login floods on sites that aren't WordPress
- Per-IP rate limits with challenge or block
- Auto-bans after repeated attacks, shared across both edges and every server of your site
- Human check for forms (login, sign-up, contact) with single-use tokens
- Full proxy mode: Let's Encrypt certificates per host, cache for static files, per-site caps, purge API
- Traffic dashboard: passed, challenged, solved and blocked by hour or day, per edge, banned IPs
- Two edges: US (New York) and EU (Europe). Each site picks its nearest, the other is the backup
Straight answers
- Two edges, not a global network: visitors far from New York and Europe get a little more latency in proxy mode.
- We stop layer-7 attacks (bots, floods of requests, scanners, brute force). Very large network floods (layer 3/4) need a network-level provider.
- Full proxy runs on the EU edge for now.