ShieldCache: Web Application Firewall Based on OWASP and HTTP Cache

Every publicly accessible website is probed around the clock, and at the same time visitors and search engines expect pages to load quickly.

With ShieldCache you solve both in one place: a web application firewall and an HTTP cache sit in front of your existing website, and your hosting stays where it is. Here you will learn how it works and how to get started.

The problem: bots, attacks and load peaks

Many attacks are automated and hit small company websites just as much as large online shops:

• Password guessing: bots call login pages such as /wp-login.php again and again with changing credentials.
• Attacks on the application: injected code for SQL injection or cross-site scripting.
• Scanners: searches for configuration files, backups and known vulnerabilities in plugins.
• Load: every one of these requests costs computing time. When many real visitors arrive as well, the website slows down.

Some of this can be caught with plugins - but only once the request has already reached your server. Protection that sits in front of it is more effective.

What is ShieldCache?

ShieldCache is a reverse proxy with a web application firewall, HTTP cache, rate limits and access rules. Your domain points to our proxy servers in Germany. There, attacks are rejected, access is limited or checked by captcha, and frequently requested content is delivered from the cache. Only checked requests are passed on to your server, the so-called origin.

Your hosting stays where it is

You keep your server, host, CMS and application - whether your website is hosted with SpeedIT or with another provider. Nothing is installed on your server; you only change the DNS records of your domain. ShieldCache works with any website that is reachable via HTTP or HTTPS.

The features at a glance

How ShieldCache works: the path of a request

Every request to your domain passes through the same stations on the proxy - only then does it reach your server:

1. Connection in Germany: the encrypted connection ends on our servers in Germany - via HTTP/1.1, HTTP/2 or HTTP/3, with a certificate from Let's Encrypt or your own.
2. Global blocklists: traffic from known abuse IPs and networks is dropped at network level.
3. Access rules: rate limits, IP rules, country and network filters, access protection and file protection take effect. For soft blocks, a captcha check can appear instead.
4. Web application firewall: the OWASP Core Rule Set checks the request. In detect mode a match is only logged, in block mode the request is rejected.
5. HTTP cache and origin: if the response is in the cache, it goes straight back to the visitor. ShieldCache forwards all other requests to your server.

Rejected visitors see an error page with an error code and reference that you can look up in the customer area.

Protection: firewall, rules and blocklists

Web application firewall based on the OWASP Core Rule Set

The web application firewall (WAF) checks every request against the OWASP Core Rule Set, the open rule set of the OWASP project, and detects attacks such as SQL injection, cross-site scripting or command execution:

• Mode: “Detect only” logs matches, “Block” rejects attacks with an error page including a reference. New sites start in detect mode.
• Inspection level: level 1 is basic protection with very few false positives, levels 2 and 3 check more strictly for increased protection needs.
• Application profiles: profiles for WordPress, WooCommerce, Shopware, Laravel, WoltLab and JSON interfaces exclude known false positives of these applications.
• Attack categories: you switch 13 groups of rules individually - for example Java attacks on a pure PHP website.

Exceptions and WAF log with reference

If a legitimate request triggers rules - such as an editor in the admin area, a form or an interface - you create an exception per path. The rules are then switched off only there; everywhere else the firewall keeps checking. You can choose between two actions:

• Release: the selected rules no longer apply on this path.
• Release & log: ShieldCache no longer blocks, but keeps writing matches to the log. This lets you observe an exception before you finalise it.

The WAF log shows all requests with rule matches from the last 30 days. From any row you create a pre-filled exception with one click. If a visitor contacts you with the reference from their error page, “Check reference” shows immediately which rule took effect.

Rate limits against password guessing and mass requests

With rate limits you define per path how many requests a visitor IP may make within a time window - with templates for login, API, form and checkout. The log shows for each rule how often it took effect and from which countries and networks the requests came.

IP, country and network rules

Allow addresses or networks, such as your office, or block suspicious senders, for a limited time if you wish. The country filter admits only selected countries or blocks individual ones; the network operator (ASN) filter works the same way with the networks of entire providers, such as data centres.

Global blocklists with known abuse IPs

Independently of your own rules, the proxy servers drop traffic from addresses and networks on global blocklists - such as botnets, scanners and known attack sources, for IPv4 and IPv6. The lists are updated continuously, and you do not need to configure anything.

Captcha check instead of a hard block

For rate limits, country and network filters and light firewall matches, ShieldCache can show a short security check instead of an error page. Anyone who passes it can continue for a configurable period. Clear attacks and IP blocks stay blocked.

The check runs via CaptchaCore, our own captcha service: without tracking and without picture puzzles, using a computational challenge (proof of work) and behavioural analysis on its own servers in Germany.

Access protection per path: IP address and/or login

A test environment or admin area should not be public? Access protection secures the whole site or paths such as /admin/ without changing your application:

• Login only: the browser asks for a user name and password.
• Allowed IP addresses only: only listed addresses or networks get through.
• IP address or login: allowed addresses without login, everyone else with login.
• IP address and login: only from allowed addresses and additionally with login.

Repeated failed attempts lead to a short block, and protected areas never end up in the cache.

File protection with exceptions

File protection profiles block typical paths of common CMS that should not be public. If you still need individual files to be public, such as downloads as .zip, you create an exception for a path and certain file extensions. Firewall and blocks still apply there.

Security headers, custom headers and Content Security Policy

Header templates add common security headers. You can also set custom headers or remove ones such as X-Powered-By.

With the Content Security Policy (CSP) you define from which sources the browser may load scripts, styles and images. In “Report only” mode the browser blocks nothing but reports every violation. You see the reports in the customer area, without IP addresses, and add required sources with one click. Then you switch to “Enforce”.

Speed: cache, HTTP/3 and compression

HTTP cache according to your rules

The HTTP cache answers recurring requests directly from the proxy. You decide how long static files stay in the cache, whether HTML is cached as well and whether ShieldCache respects the cache settings of your server. Paths such as the admin area and cookies such as login or shopping basket bypass the cache.

Templates for WordPress, WooCommerce, Shopware 6, Joomla and static websites add common paths, cookies and parameters with one click. After an update you clear the cache immediately - completely, for one path or for everything below a path.

HTTP/2, HTTP/3 and compression

ShieldCache speaks HTTP/1.1, HTTP/2 and HTTP/3 with QUIC; browsers choose the right protocol themselves. If you wish, ShieldCache compresses responses with Zstandard or gzip, and you set HSTS separately.

Resilience and relief for your server

If your server does not respond, ShieldCache continues to deliver content that is already cached for a configurable period. If your website runs on several servers, you can add up to four further origins - for resilience or load balancing, with a health check.

Control and transparency

Statistics with real measured values

The statistics show requests, traffic, cache ratio, response time and how many requests never reached your server, plus blocks by type, captcha checks, countries and the most requested paths. All values are measured, not extrapolated, and do without IP addresses.

Logs and references

In addition to the WAF log, logs for rate limits and access blocks show when, from where and by which rule a request was rejected - each with the reference of the error page.

Versions, operating mode and error pages

You first collect changes in a draft and apply them to the proxy with one click, usually in under a minute. Every applied version is saved, and you can restore an earlier one if needed. With the operating mode you pass requests straight through to your server without checks in an emergency or show a maintenance page. In the Enterprise plan you design error, maintenance and check pages with your logo, your colour, your name and your own maintenance text.

Working as a team

If several people or your agency work with your account, you grant specific rights via account access: view ShieldCache, manage ShieldCache or only clear the cache.

Domains, redirects and certificates

Verify and switch domains

For each site you enter a main domain and further domains of the same registrable domain, such as www.muster.de and muster.de. Each domain is verified via a TXT record - if it is in your domain portfolio with us, this happens automatically. You then point the domain to ShieldCache via a CNAME or A/AAAA record. If you wish, the www redirect sends visitors consistently to the address with or without www.

Redirect domains at no extra cost

Should a further domain only redirect to your website - for example the old muster.de to the new muster.eu -, you add it as a redirect. You choose the status code (301 or 308 permanent, 302 or 307 temporary; 307 and 308 keep the method, so a form stays a form) and whether the path is kept. Redirect domains may belong to a different domain, are free of charge and put no load on your server.

Certificates: automatic or your own

For every verified domain, ShieldCache automatically issues and renews a certificate from Let's Encrypt. If the first attempt right after the DNS change fails, the proxy repeats it by itself - or you trigger it immediately with “Request again”. Alternatively, you upload your own certificate.

Moving from another protection service

If your application expects the visitor IP in the header of a previous protection service, simply enter its name. This way you move without adapting the application.

Data protection and location in Germany

ShieldCache is operated by SpeedIT on proxy servers in Germany. Data minimisation is built in:

• The statistics do without IP addresses.
• In the logs, IP addresses are kept in full for 7 days and shortened afterwards (IPv4 to the /24 network, IPv6 to /48). After 30 days the entries are deleted.
• ShieldCache determines the country and network of a visitor using a local database - the IP address does not leave the proxy for this.
• CSP reports are stored without IP addresses and disappear 30 days after the last report.
• Passwords for access protection are only stored as a hash, and sensitive values in the firewall findings are masked.

Who is ShieldCache for?

WordPress websites

The cache template, firewall and file protection profile for WordPress are set with a few clicks. A rate limit with captcha check slows down password guessing on /wp-login.php without locking out real users.

Online shops with WooCommerce or Shopware

The cache templates exclude shopping basket, checkout and customer account from the cache and add session and basket cookies. Callbacks from payment providers that show up in the WAF log are released specifically for their path.

Agencies and multiple websites

Each website is a separate site in the project, with its own domains, rules and statistics. Via account access, your team works with the right permissions.

Apps, interfaces and WebSockets

ShieldCache passes WebSocket connections through without any further setting, including for applications with persistent connections such as SignalR or Blazor Server. The firewall profile for JSON interfaces, paths without cache and rate limits per path adapt ShieldCache to your interface. Proven settings are shown in the practical examples.

Ready in just a few steps

You do the setup yourself in the customer area - without a setup fee and usually in a few minutes:

1. Order a plan: after ordering, your project is ready under My products.
2. Create a site: enter a name and the main domain, for example www.muster.de.
3. Verify the domain: create the TXT record from the DNS guide.
4. Enter the origin: provide the IP address or host name of your server and test the connection.
5. Apply: choose a cache template and apply the settings.
6. Change DNS: point the domain to ShieldCache via a CNAME or A/AAAA record. The certificate is issued automatically.

Prefer to hand it over? With the optional express setup our team sets up your sites for you. You will find the detailed guide with screenshots in the knowledge base: Setting up ShieldCache.

Plans at a glance

Firewall, cache, access rules, captcha check and statistics are included in every plan. The plans differ in the number of websites, the request quota and the rate limit paths:

You can add further websites and rate limit paths as options. Every HTTP request counts, including those for images and scripts. There is no setup fee. You will find current prices on the product page.

Frequently asked questions about ShieldCache

Further reading in the knowledge base

• ShieldCache at a glance
• Create a site, verify the domain and change DNS
• Configure the firewall, create exceptions and read the WAF log
• IP rules, countries, network operators, rate limits and captcha check
• Protect areas with a password or IP allow rule
• Adapt the cache to your website
• Content Security Policy and custom headers
• Frequently asked questions and troubleshooting

Related: for protection against DDoS attacks we offer our threat protection, and for faster loading times worldwide our content delivery network.