Protection for the agentic era.
A firewall and DNS in front of every site you run. Every change — made by your team or by an AI agent — is checked, signed, versioned and one command from undo.
Two nameservers to switch. Nothing to install.
In front of every site you run
Presets for the stacks your agency already runs
- WordPress
- Next.js
- Static sites
- Any HTTP origin
- Let’s Encrypt TLS
A firewall in front of every client site
Every request to a proxied hostname is inspected on our edge nodes in Germany: WAF rules, rate limits, IP and country rules, and an access gate for admin areas.
Rule levels
from low to high
Choose how strict the rules are for each site, and try them in log-only mode first.
An access gate
for /wp-admin
Admin paths wait at the edge until the visitor enters a one-time code sent by e-mail.
Rate limits
per IP and per path
Slow down password guessing on POST /wp-login.php, scraping and noisy API clients.
Active, log-only
or off
Log-only records what would have been blocked, so you can tune a site before enforcing.
Per-site exceptions
when a rule gets in the way
Switch a rule off for a site or a path when it trips over a legitimate plugin or form.
Stack presets
for a quick start
Start each site from a WordPress, Next.js, static or generic preset, then adjust.
IP and CIDR lists
per site
Allow or block single addresses and whole ranges.
Country rules
allow or block
Decide which countries can reach each site.
Threat-intelligence feeds
updated automatically
Block addresses that appear in threat-intelligence IP feeds.
Limits per IP
at the edge
Excess requests are rejected by our nodes, so your server never sees them.
Limits per path
and method
Tighter limits for login forms, an API endpoint or a search page.
Size and time-out
towards the origin
Cap the request size and how long the edge waits for your origin.
HSTS
per site
Turn on HTTP Strict Transport Security when a site is ready for it.
gzip and Brotli
at the edge
Responses are compressed on the way out. Nothing is cached.
CORS and redirect
allow-lists
Control which origins may call a site’s APIs and where it may send visitors.
Every change has an author, a reason and a way back. Edge nodes only apply what the control plane has signed.
How OpenWAF handles configuration
Ed25519-signed documents · versioned history · one-step rollback
Read how it worksEvery change on the record, and one step back
Each change creates a version with its author, its reason and a diff. Nodes apply the signed document in under a minute, and any earlier version can be restored in one step.
History and diff
See who changed what on each site, when and why.
One-step rollback
Restore an earlier version of a site with one command.
Propagation
Watch every node apply the new version, in under a minute.
Your own nameservers, certificates included
Each account has a fixed nameserver pair under ns.openwaf.dev. Delegate a domain to it and OpenWAF answers its DNS, proxies the hostnames you choose and issues their certificates.
Built for agencies
Made for teams that look after dozens of client sites
Most firewalls are designed around one company and one website. OpenWAF starts from an agency’s day-to-day: many domains, many stacks and several people making changes.
- One nameserver pair for every client
- Presets for WordPress, Next.js and static sites
- Mandatory change reasons and an audit log
- The API and the
openwaf-cloud ctlcommand line
Coming soon
- Configuration templates for many zones at once
- Edge caching with purge
- DNSSEC
- More locations and anycast
FAQ
Questions agencies ask us
What does “early access” mean?
OpenWAF is running and protecting real sites, and anyone can create an account at dash.openwaf.dev. Some features are still on the way and there is no SLA yet.
It is free and without limits, under the fair-use rules of the Acceptable Use Policy.
How do I get started?
Create an account with a one-time code sent to your e-mail, or with Google or GitHub; there are no passwords. Name your agency, accept the terms and add your domains one by one or in bulk: we detect their existing records and give you the nameserver pair to set at each registrar.
Do I have to change the nameservers? Can I use a CNAME instead?
Today onboarding is by nameservers only: the domain is delegated to your OpenWAF pair and we answer all of its DNS. That is what lets us issue certificates automatically and switch proxying on or off per record.
Will moving the nameservers break e-mail or other services?
Not if the zone has the same records as before. Records that aren’t proxied, like MX for e-mail, are answered exactly as you define them. Review the zone before changing the nameservers.
Where do you run?
Edge nodes and DNS servers are in Germany, on Hetzner. We don’t have an anycast network yet; more locations are planned.
What happens if your control plane goes down?
Edge nodes keep serving with the last valid, signed configuration they received. You can’t make changes until it is back, but traffic keeps flowing and stays protected.
Do you cache our content?
No. OpenWAF is a firewall and reverse proxy: requests are inspected and forwarded to your origin. Responses can be compressed with gzip or Brotli, but they aren’t cached.
Can our clients log in?
Yes, if you want them to. Group zones by end client and invite a client’s people with access limited to that client’s zones. With white label they see your brand, your own dashboard domain and your own nameservers.
How will pricing work later?
Paid plans will come later and prices aren’t set yet. We will tell you at least 30 days before any paid plan applies to your account, and nothing will be charged without your explicit agreement. See Pricing.
