Changelog

Everything we've shipped to the HexShield protection layer and client area, newest first.

October 2026

• Layer 7 accuracy update. Images, fetch/XHR and API calls are no longer counted as challenge failures, verified search-engine crawlers are never banned, shared networks (offices, mobile carriers) get a fair solving window, IPv6 limits apply per /64, a random-Host flood can no longer push real domains into “not configured”, and a ban can never cut a site off from its own origin server.
• Custom WAF rules. Match requests by path, HTTP method, User-Agent, header, query string, country, network (ASN) or IP address — combine up to four conditions with AND — and pick the action: allow, block (403), challenge, or per-IP rate-limit. First match wins, all managed from the panel.
• Built-in firewall controls. One toggle each for challenging datacenter / hosting IPs (residential visitors are untouched), honeypot trap paths, and empty or known automation-tool User-Agents.
• Per-domain attack alerts. Get notified the moment your domain comes under attack — and when it clears — through your own webhook, Telegram or email, with a one-click test.
• Setup wizard. A guided first-domain flow: add your site, point DNS at the edge, watch the SSL certificate go live.
• Two-factor authentication (TOTP) for the client area, with any standard authenticator app.
• Threat-intelligence blocklists. Known-bad networks from curated public feeds are dropped in the kernel before they cost any CPU. Only low-risk lists are on by default and the operator controls every list. A new sustained-load shield also limits how many brand-new connections from unknown sources are accepted per second if server CPU stays high during a flood (during a very large flood, first-time visitors may be unable to connect until it eases); visitors the edge already knows are not affected by this limit.
• Mitigation hardening. Adaptive proof-of-work is tuned so real users behind shared NAT / CGNAT are never locked out, and ban thresholds no longer react to coarse signals on their own.

September 2026

• Always-Online. Serve cached pages to visitors even while your origin server is down.
• SEO protection mode. Verified search-engine bots pass freely; impostors are still challenged.
• Custom challenge screen. Bring your own HTML / CSS for the verification page.
• Redirect rules by path, prefix or whole-site.
• Analytics breakdowns, image optimization and three-level edge caching (Easy / Medium / Hard).
• Maintenance mode, country geo-blocking (block or allow-only) and IP allow / block lists.
• Challenge types: JavaScript, checkbox captcha, image captcha, or none.

Dates reflect when a feature reached the production edge. Security internals are deliberately kept high-level.