Everything in front of your clients’ sites

Off, low, medium or high: choose how strict the rules are for each site.

Active mode blocks. Log-only records what would have been blocked, so you can tune a site before enforcing. Off disables the WAF for that site.

Switch a rule off for a site or a path when it gets in the way of a legitimate plugin or form.

Start from WordPress, Next.js, static or generic presets.

Show a block page with your client’s branding instead of a generic error.

Requests to a protected path are held at the edge until the visitor proves who they are.

Authorised people receive a one-time code by e-mail, sent from [email protected].

Decide who can reach each site’s admin area.

Limit how many requests a single address can make.

Set tighter limits for POST /wp-login.php, an API endpoint or a search page.

Excess requests are rejected by our nodes, so your server never sees them.

Single addresses or CIDR ranges, per site.

Allow or block traffic by country.

Block addresses that appear in threat-intelligence IP feeds, which are updated automatically.

Issued automatically with DNS-01 or HTTP-01 validation.

Renewal starts 30 days before a certificate expires.

Upload a certificate manually when a client needs a specific one.

Turn on HTTP Strict Transport Security per site.

Each account has its own pair under ns.openwaf.dev, named after navigation: faros, polaris, meridian, azimut, sextant, compass, harbor, nautilus, portolan and beacon.

The primary isn’t reachable from the Internet; public secondaries in Germany answer the queries.

Choose which hostnames go through the WAF; everything else gets plain DNS answers.

Editing records from the web dashboard is on the way.

gzip and Brotli compression at the edge.

Control which origins may call the site’s APIs from a browser.

Limit where the site may redirect visitors, to stop open-redirect abuse.

Maximum request size and time-out towards the origin.

Every change creates a new version you can compare with earlier ones.

Go back to a previous version of a site’s configuration in one step.

Every change records why it was made.

Edge nodes only apply configuration documents with a valid signature.

If the control plane can’t be reached, nodes keep serving the last valid configuration.

Changes reach all edge nodes in under a minute.

Who changed what, on which site, when and why.

Blocked and logged requests per site, with the rule that matched.

Traffic figures per site.

Manage zones, DNS records, site settings and rules over the API, with tokens that expire and can be revoked.

openwaf-cloud ctl for scripted, repeatable operations.

With e-mail, Google or GitHub.

At app.openwaf.dev.

Bring many domains at once.

Edit records from the dashboard.

Organise sites by client.

Present the service under your agency’s brand.