A firewall in front of your site, not inside it.
Attacks are stopped at the edge, before they reach the server your application runs on. The basic protection is on every delivery zone at no charge.
Shield Standard
Included
on every delivery zone
- Included on every delivery zone
- managed rule set
- DDoS mitigation
- JS challenge
- 2 rate limits
Shield Premium
₹1,499
per month · ₹14,990 a year
- Per delivery zone
- 10 custom firewall rules
- 10 rate limits
- rate windows up to a day
- access lists
What each tier actually gives you
The difference is control, not protection. Both tiers stop the same attacks; Premium lets you write your own rules for the traffic that managed rules cannot know about.
- Standard, included free: managed rule set updated as new attacks appear, DDoS mitigation, JavaScript challenge for suspicious traffic, and two rate limits.
- Premium: ten custom firewall rules of your own, ten rate limits, rate windows up to a full day, and access lists.
The protections, one by one
Blocking attacks
| Capability | What it does for you |
|---|---|
| Managed firewall rules | A maintained rule set covering the common injection, traversal and exploit patterns. It is updated for you as new attacks appear — you do not maintain it. |
| DDoS mitigation | Volumetric floods are absorbed across the edge network. Your origin sees normal traffic while an attack is in progress. |
| JavaScript challenge | Suspicious visitors must run a small challenge before being served. Real browsers pass it without noticing; most bots do not. |
| Custom rules | Your own conditions on path, header, country, address or user agent — block, challenge, or explicitly allow. Ten of them on Premium. |
Controlling who gets through
| Capability | What it does for you |
|---|---|
| Rate limiting | Cap requests per address over a window. Two limits free, ten on Premium, with windows up to a day — enough to stop slow credential stuffing, not just fast floods. |
| Country blocking | Allow or deny whole countries without touching your application code. |
| IP allow and block lists | Pin admin access to your own addresses, or block a specific source outright. |
| Connection limits per address | Stops one client holding open hundreds of connections. |
Protecting your content
| Capability | What it does for you |
|---|---|
| Referrer control | Blocks other sites embedding your images and spending your bandwidth. Allow your own domains and deny the rest. |
| Token authentication | Signed URLs that expire. A link to a paid download works for the buyer and stops working afterwards, so it cannot be posted publicly. |
| Block direct root access | Stops people browsing the delivery hostname directly rather than reaching your site. |
| Block POST requests | For zones that serve only static assets, refusing writes removes a whole class of abuse. |
Transport
| Capability | What it does for you |
|---|---|
| Free SSL, renewed automatically | Certificates for every hostname, issued and renewed without you doing anything. |
| Force HTTPS | Every plain request redirected, per hostname. |
| TLS version control | Disable older TLS when compliance requires it. |
| Origin certificate verification | The edge validates your origin's certificate instead of trusting whatever responds. |
About edge security
Do I need Premium?
Most sites do not. The free tier covers ordinary background noise — bots probing for WordPress exploits, scrapers, small floods. Premium earns its place when you need a rule specific to your site: rate-limiting one endpoint differently, or blocking a pattern only you would recognise.
Does this replace security on my server?
No, and anyone who tells you otherwise is selling something. This stops traffic before it arrives. It does not patch an out-of-date plugin or fix a weak password. On our hosting, Imunify360 handles the server side and scans every account — the two work together.
Will it block real visitors?
The managed rules are tuned to avoid that, and the JavaScript challenge lets genuine browsers through without a captcha. If something legitimate does get caught, tell us and we will find the rule and adjust it.
What about my WordPress login page?
A good use for a rate limit: cap attempts on wp-login.php to a handful per minute per address and credential stuffing stops being viable. We will set that up for you if you ask.
Does it protect my origin directly?
Only traffic that comes through the delivery zone. If someone knows your origin address they can reach it directly, which is why you should firewall your origin to accept traffic from the edge only. We will help you do that.
An honest limit
Edge security protects what comes through the edge. If your origin address is public and unfirewalled, an attacker can bypass all of this by going straight at it. Ask us and we will lock your origin down to accept edge traffic only.
Turn on protection
Standard is already on every zone. Premium is a click away in your dashboard.