Protect and speed up your website with ShieldCache

Every new site starts in detection mode: the firewall checks all requests and writes matches to the WAF log, but does not block anything yet. This shows you whether legitimate requests trigger rules - for example a form, an editor or an API.

For such cases you add exceptions per path: "allow" disables the affected rules there, "allow & log" no longer blocks but keeps writing matches to the log. You switch entire attack categories individually: SQL injection, cross-site scripting, local and remote file inclusion (LFI/RFI), PHP, Java, command execution, session fixation, request smuggling, scanners, protocol violations, multipart and generic attacks.

Then you switch to blocking with one click. The protection level and profiles for WordPress, WooCommerce, Shopware, Laravel and other applications help with fine-tuning.

Login pages, contact forms and APIs are popular targets for automated attacks. With rate limits you define per path how many requests are allowed within a time window. If the limit is exceeded, ShieldCache rejects further requests - or, if you wish, shows a captcha check so that real visitors can continue.

In the rate limit log you see for each rule how often it applied and from which countries and networks the requests came. The number of paths depends on the plan and can be extended in packages of five paths each.

The HTTP cache answers recurring requests directly and relieves your server. You decide whether HTML is cached as well with its own lifetime, whether ShieldCache respects or overrides the cache headers of your server and how long browsers keep static files. You always or never cache specific file types, ignore or sort query parameters, and cookies such as login or cart bypass the cache.

Templates for WordPress, WooCommerce, Shopware 6, Joomla and static websites add common paths, cookies and parameters. If your server fails to respond, ShieldCache keeps delivering content that is already cached for a configurable time. After an update, you purge the cache with one click - completely, for a path or a prefix.

ShieldCache speaks HTTP/1.1, HTTP/2 and HTTP/3 with QUIC - browsers choose the fastest protocol themselves. If you wish, ShieldCache compresses responses with zstd or gzip, and you configure HSTS separately.

If your website runs on several servers, you add up to four additional origins: for failover or load balancing, with regular health checks. You set the timeouts to the origin, the headers carrying the visitor IP and the maximum request size yourself.

If several applications run under your domain - such as the website, an API and a WebSocket service -, path rules distribute the requests: each path, for example /api/, goes to a separate server with its own port. You no longer need a proxy of your own on your server for this.

Example: with the rule /api/ → 203.0.113.20:8080 and “Remove path prefix”, calls to www.muster.de/api/users go to the API server as /users, everything else goes to your origin as before. You choose per rule whether the cache applies to a path - by default, requests go straight to the target. WebSockets are passed through, and the firewall, rate limits and access rules also apply to these paths.

Starter includes 3, Professional 10 and Enterprise 25 path rules per website. Step by step: Path rules: several applications under one domain.

Allow individual IP addresses or entire networks - for example your office or your agency - or block suspicious senders, optionally only for a certain time. With the country filter you allow only selected countries or block individual countries, with the ASN filter the networks of entire providers, such as data centres. Global blocklists of known abuse IPs and networks are updated continuously and take effect at network level.

Instead of a hard block, a captcha check can be shown for rate limits, country and ASN filters and minor firewall matches. Clear attacks stay blocked. The check runs via CaptchaCore, our own GDPR compliant captcha service (captchacore.eu).

File protection profiles block typical paths of common CMS that should not be publicly accessible, and security headers complement the responses of your website.

A staging environment, an admin area or an internal page should not be public? With access protection you open the whole site or individual folders only to specific IP addresses, require a user name and password, or combine both.

Repeated failed attempts lead to a temporary block - this slows down password guessing. Protected content never ends up in the cache, and your application does not need to be changed.

If ShieldCache rejects a request - through the firewall, a rate limit, an IP, country or network rule - or your server cannot be reached, the visitor sees a dedicated error page with an error code and reference.

If a customer contacts you with this reference, you look it up in the customer area and see which rule applied. This lets you resolve false alarms quickly.

In the Enterprise plan you design error, maintenance and check pages yourself: with your logo, your colour, your name and your own maintenance text.

The statistics show requests, traffic, the share served from the cache and how many requests never reached your server. Plus blocks by reason, countries, most requested paths and response times - updated live. All values are measured, not extrapolated.

Privacy is built in: the statistics work without IP addresses. In the log, IP addresses are shortened after 7 days and deleted after 30 days. ShieldCache determines countries and networks with a local country and network database - the IP address does not leave the proxy for this.

You first collect settings in a draft and apply them to the proxy with one click. Every applied version is saved - you can restore an earlier one if needed.

In an emergency, you pause the protection of a site or show a maintenance page.

All prices incl. VAT per month, net in brackets:

• Additional protected website: €11.78 (€9.90)
• 5 additional rate limit paths: €5.83 (€4.90)
• Custom certificate (Starter, Professional): €5.83 (€4.90) - included in Enterprise
• Additional requests above the quota: €5.83 (€4.90) per started 100,000 requests

Express setup by our team: one-time €99.00 incl. VAT (€83.19 net), optional. You book options when ordering or later in the customer area.