Documentation

Getting started

HexShield is a hosted service: there is nothing to install on your server. Your traffic is proxied and filtered on the HexShield edge, and clean requests are forwarded to your origin.

1. Sign up. Create an account with the Get Started button. The account is free; protecting a domain requires Pro ($50/month, up to 2 domains), which you buy inside the panel in crypto via NOWPayments.
2. Add your domain. In the panel choose Add Site and enter your domain together with the public IP of the server that currently hosts it (your origin).
3. Point your A record. At your DNS provider, set the A record of your domain (and of www) to the HexShield edge IP shown in your panel.
4. Adjust the origin (optional). If your origin moves or listens on another port, update it later from the panel — no DNS change is needed for that.
5. Done. Once DNS propagates, the certificate is issued automatically and traffic to your domain is filtered before it reaches your origin.

DNS and SSL

Add your domain and origin IP in the panel, then point your domain's A record at the HexShield edge IP shown in your panel. Once DNS propagates the certificate is issued automatically through Let's Encrypt and renewed automatically.

From that point your origin IP is no longer visible from outside. Remember to clean up old A records, stray subdomains and MX/SPF entries pointing at the origin — that is the most common way an origin IP leaks.

# Your DNS records
example.com.        A     <HexShield edge IP from your panel>
www.example.com.    A     <HexShield edge IP from your panel>

# Do not leak:
# direct.example.com A   <origin IP>   <-- DELETE THIS
# mail.example.com   A   <origin IP>   <-- move to a separate host

Using the panel

The panel's tabs include Overview (traffic chart and quick switches), Analytics (breakdown tables), WAF & Security (16 on/off switches plus a security level and a cache level), DNS & SSL, Access Control (country and IP rules), Maintenance and Support Tickets. Every WAF switch carries a description of what it does and what it risks.

Every change reaches the edge instantly — no restart, no waiting. After a save the edge cache for that domain is purged immediately.

Verification settings

There are two separate settings and they are easy to confuse: “Verification” decides WHEN the screen appears (Off / Only during an attack / Always), “Screen” decides HOW it looks (automatic / checkbox). To turn verification off entirely, set the first one to Off; the second has no effect then.

Both screens use JavaScript in the background — that is what proves the visitor is a real browser. Choosing the checkbox does not weaken protection; what the server verifies is the same proof-of-work in both modes.

Country and IP rules

Two modes: “block listed countries” and “allow ONLY the listed ones”. The second is powerful; saving it with an empty list is refused, because that would block everyone — including you.

Allow-listed IPs are exempt from every check: rate limits, WAF scanning and verification are all skipped. Adding your own office address and your monitoring services is recommended.

Cache levels

Four levels: off, easy (static assets only), medium (static plus a 60-second HTML micro-cache for visitors carrying no cookie of their own) and hard (static plus the micro-cache for anyone without a session cookie).

Never cached at any level: POST and other non-GET requests, anything carrying an Authorization header, and personal paths such as /admin, /account and /api/ — even when the URL ends in .png or .js.

Troubleshooting

If your site is not behaving as expected, first check that your domain's A record points to the HexShield edge IP shown in your panel, then run the origin ping test from the panel to confirm HexShield can reach your origin. If both look right, open a ticket in the panel.

If you suspect something about the verification page, check the X-HexShield-Challenge response header in your browser's network tab: it says captcha, js or js_fallback. If you see js_fallback, open a ticket in the panel and mention that header.

# Does your domain point at the HexShield edge?
dig +short example.com A
# -> should print the edge IP shown in your panel

dig +short www.example.com A

Security notes

Use a strong, unique password for your HexShield account. If you suspect someone else has access, change it and sign out all sessions from your profile in the panel. Add your own office address and your monitoring services to the IP allow list so they are not challenged.

Once your site is behind HexShield, restrict your origin's firewall so ports 80 and 443 only accept connections from the HexShield edge IP. Otherwise an attacker who learns your origin address can go around the protection.