Real controls you switch on and off from the panel, each one documented. Everything below is included in Pro — no add-on modules, no extra charges, nothing to install.
The cheap check runs first. The further a request gets, the more it costs, so the cheapest gate sits at the front.
At the very first point of the network stack: SYN floods, null/xmas scans, invalid flag combinations, ICMP floods, per-IP TLS handshake rate (20/s), concurrent connection count and port-80 new-connection rate. A banned address never reaches the application layer.
A 5-second window measures bursts, a 60-second window measures sustained load. Both ask for verification first; a client that exceeds them three times in 60 seconds without ever verifying is pushed down to the kernel. Images, CSS and JS are counted separately.
Cache-buster attacks that hit one path with an endlessly changing query are measured per path. HTTP/1.1 pipelining (the technique behind Meris-class botnets) is counted per connection and switches itself off behind a CDN.
Sixteen on/off switches, plus a security level and a cache level. Only the low-risk ones are on by default, and each switch is labelled with its risk in the panel.
SQLi, XSS, RCE and LFI signatures, both in the URL and in POST/PUT/PATCH bodies. Body inspection runs under a per-second budget and lets the request through if the engine is unreachable.
Probes for /.env, /.git, /wp-config are blocked; /wp-login.php and /xmlrpc.php are rate-limited against brute force. Over the limit only that path returns 429 — the rest of the site stays reachable.
Drops security scanners (sqlmap, nikto, nuclei, wpscan) by User-Agent. Bot Fight Mode sends non-browser-looking requests to verification rather than blocking them. Search engines are always exempt.
Block listed countries or allow only the listed ones. The GeoIP database refreshes itself weekly. IP/CIDR allow and deny lists, up to 1000 entries each.
Content-Length together with Transfer-Encoding (request smuggling), absurdly long URIs and User-Agents, NUL and control characters inside the URL. None of these can occur in a real browser.
Four edge cache levels plus format-negotiated image caching (separate entries for WebP/AVIF). Personal paths and requests carrying Authorization are never cached at any level.
Verification checks that the browser really is a browser. Usually invisible to a human, and costly for a simple bot.
The server issues a proof-of-work challenge whose difficulty is signed inside the token itself. Because the difficulty travels with the token, an honestly solved challenge is never rejected later just because a setting changed.
It is solved in the background, typically in a few hundred milliseconds. The visitor clicks nothing; you can switch to a checkbox screen instead (same protection, only the appearance changes).
The cookie is bound to the visitor's /24 subnet and browser signature and signed with HMAC, so a cookie copied to another network is not accepted. While it is valid, verification does not appear again.
For the next 30 minutes the same visitor is not asked to verify again.
The level is a multiplier on the rate windows. The values below are for unverified visitors; a verified visitor gets a far wider budget at every level.
| Level | 5s window | 60s window | Who it's for |
|---|---|---|---|
| Off | no limit | no limit | While troubleshooting |
| Low | 90 requests | 600 requests | APIs and very busy sites |
| Medium (recommended) | 45 requests | 300 requests | Most sites |
| High | 22 requests | 150 requests | While being probed |
| I'm Under Attack | 22 requests | 150 requests | During an active attack |
| What happens when exceeded | verification asked | verification asked | Persistent clients dropped |
Nothing to install. Point your DNS at the HexShield edge, keep your origin IP out of sight, and filter attacks before they reach your server.
