Real-time protection, from the kernel up.
HexShield is a hosted WAF and anti-DDoS service that sits in front of your site. Point your domain's A record at the HexShield edge and your traffic is filtered in three layers, from the kernel up to the application — there is nothing to install on your server.
The account is free. Pro — $50/month, up to 2 domains — is purchased inside the panel after you sign up.
HexShield sits in front of your site: attacks are filtered and your platform stays protected and verified.
Shared office, school and CGNAT addresses are challenged, never blocked. A ban only lands on a client that keeps failing verification.
If the inspection engine is ever unreachable or over its budget, the request is let through. The protection layer is built to fail open.
Visitors only ever see the HexShield edge — never your real server, not in DNS, not in the certificate, not in response headers.
Security level, country and IP rules, cache mode — every change reaches the edge within seconds, with no restart and no downtime.
Nothing to install on your server. Nothing in your application has to change.
Create an account, then buy Pro inside the panel: $50/month for up to 2 domains, paid in crypto via NOWPayments.
Enter your domain and origin IP in the panel, then point your A record to the HexShield edge IP shown there. The certificate is issued automatically and your origin IP no longer appears in your DNS.
Security level, verification type, country and IP rules, cache mode — all from the panel. Changes reach the edge instantly; no restart.
Each layer stops a different class of attack at its own cost level. The cheap one runs first.
Packets are dropped at the very first point of the network stack, before any application code runs. SYN floods, invalid flag combinations, per-IP TLS handshake rate and concurrent connection counts are capped here. A banned address costs zero CPU on every request after that.
Every request runs through checks ordered cheapest-first: ban list, IP and country rules, rate windows, query-string flood detection, bot signatures. A request that fails never sees your origin.
Bodies that made it this far are scanned against SQLi, XSS, RCE and LFI signatures. It runs under a per-second budget and lets the request THROUGH if the engine is unreachable — the protection layer is designed not to take your site down.
What every switch does is written in the panel — and it actually does what it says.
L3/L4 floods stop in the kernel, L7 floods at the edge. Two separate windows for burst and sustained load; both ask for verification first and only drop a client that keeps failing it.
Visitors only see the HexShield address. HexShield does not expose your real server address in DNS, in the certificate or in response headers.
Requests hitting the same page with an endlessly changing query make caching useless and open a database query each. Measured per path; unverified traffic over the threshold is stopped.
Block listed countries, or allow ONLY the listed ones. IP and CIDR allow/deny lists; an allow-listed address is exempt from every check.
Country, HTTP method and version, browser, device, OS, cache status, most-requested and most-attacked paths. No invented numbers — all of it comes from the edge.
A themed maintenance page behind one switch (503 + Retry-After, so search rankings survive). Four edge cache levels: off, static only, cookieless HTML, session-free HTML.
The design rule behind this product: a false positive is worse than a missed attack. A blocked customer costs more than a bot that got through.
So the rate limits ask for verification first instead of banning. Dozens of real users behind one shared egress address (an office, a school, CGNAT) are not thrown off the site because of what one of them did. A ban only lands on a client that fails verification again and again.
They are good at different things. The choice is about whose network your traffic crosses.
| Topic | HexShield | Large CDN/WAF networks |
|---|---|---|
| Who handles your traffic | HexShield's own edge only | The provider's global network |
| Changing rules | Instant, unlimited | Depends on plan |
| Cost model | Flat monthly | Often usage-based |
| Global anycast capacity | No — dedicated HexShield edge | Yes |
Let's be honest: a volumetric attack of hundreds of Gbit/s can exceed the link capacity of the HexShield edge, and no software changes that. HexShield filters what fits down that link; attacks beyond it are listed as an exclusion on the Service Level page.
No. HexShield is a hosted service: sign up, add your domain in the panel and point its A record to the HexShield edge IP shown there. The filtering — at the network, edge and application layers — runs on our servers, not on yours.
Checks are ordered cheapest-first and a verified visitor passes almost all of them. With edge caching on, cached requests are answered at the edge without reaching your origin, so for many sites page loads get faster.
No. The default mode is 'only during an attack' and verification runs in the background — the visitor clicks nothing. You can switch to a checkbox screen, or turn verification off entirely.
Yes. Pick your CDN provider in the panel and HexShield reads the real visitor IP from the right header and automatically disables the rules that stop making sense behind a CDN (such as pipelining detection).
Unconditional refund within the first 7 days, whatever the reason. Payment is taken in crypto via NOWPayments and refunded through the same channel.
Nothing to install. Point your DNS at the HexShield edge, keep your origin IP out of sight, and filter attacks before they reach your server.
