Custom WAF rules that never lock out a real user
Match on path, User-Agent, header or query, then choose allow, challenge, rate-limit or block — with one guardrail the engine enforces: no rule can block every visitor.
HexShield / Blog
Blog
Real attacks, real fixes. Everything written here is implemented in the product and locked down by a test.
The query-string flood: an L7 attack that makes caching useless
One of the cheapest ways to take a site down with only a few hundred requests a second. Why rate limiting alone cannot catch it, and why the thing to measure is the path, not the IP.
HTTP/1.1 floods and the 426 trap
Why most attack tools still speak HTTP/1.1, why a “require HTTP/2” switch is not as good an idea as it looks, and what the right answer is.
Rule number one: don't block real users
Why rate limits ask for verification instead of banning, why shared egress addresses matter so much, and how we test it.
Actually hiding your origin IP
Getting behind a WAF is not enough on its own. Origin addresses leak most often through DNS history, mail records and certificate transparency logs.
How proof-of-work verification works
What sits behind the verification screen a visitor passes without doing anything: the signed challenge, the difficulty race problem, and what the clearance cookie is bound to.
Put your site behind the shield today
Nothing to install. Point your DNS at the HexShield edge, keep your origin IP out of sight, and filter attacks before they reach your server.