Self-hosted and sovereign
You install it on your servers: traffic does not leave your infrastructure. Rule feeds are downloaded by the control plane and can be imported offline.
حول
ToutWAF is a complete web application and API protection (WAAP) that you host yourself: what it protects, how it is designed, where the product stands, what it does not do, and where to find help.
What it is
A WAF inspects HTTP traffic and blocks attacks such as SQL injection; a WAAP adds what modern applications need.
Detection first
A new site starts in detection mode: attacks are recorded, nothing is blocked. A report says what would have been blocked before you switch to blocking, and you can roll back in one click.
Explainable
Every event shows which rule matched, on what data, and offers “this is a false positive” with a preview of the narrowest exception.
The data plane does not depend on the control plane
It keeps the last good policy on disk and keeps protecting if the control plane is down. A licence or a quota never interrupts traffic.
What it protects
The main families, detailed on the features page.
- Application attacks (SQL injection, XSS, command and file inclusion, SSRF, XXE, deserialization) and protocol abuse.
- Bots and fraud, request floods (rate limits, “under attack” mode), access control by address, country and reputation.
- APIs (schema validation, JWT, API keys), data leaks in responses, browser-side security (CSP, headers, cookies).
- The tools to run all of it: simulation, gradual rollout, rollback, policy as files.
Where the product stands
We prefer to say it plainly.
- The public version is a development version, 0.3.0-dev. No stable version exists: it will only be published once everything has been tested end to end.
- Functions that work in the tests but were never tried with the real service, system or equipment carry the note “not yet tried in real conditions” in the console and on this site. The firewall, the VPN and the mail gateway are experimental and off by default.
- The performance and detection figures in the documentation come from the project's own synthetic corpus and a shared virtual machine: they are not independent measurements.
- The documentation also lists what is not done or not verified on real systems.
What it does not do
Said plainly, so as not to promise too much.
- HTTP/3 is not offered; the collective defence network is not offered in this version.
- One active control plane: a standby console follows it and is promoted by hand. Data is in SQLite, PostgreSQL is not implemented.
- The Kubernetes operator and the Terraform provider are skeletons, not finished products.
- ToutWAF never manages your DNS records: it tells you which to create and checks them.
Getting help
From the simplest to the most direct.
- The ToutWAF Doctor in the console diagnoses the machine, ports, DNS, certificate and origin, and says what to do.
- The documentation covers troubleshooting by symptom, the FAQ and every TW-xxxx error code with its cause and fix.
- When you report a problem, attach the Doctor report, the version, the incident ID and the error code, never a token or a key. Write to us from the Contact page.
- A vulnerability is reported privately, from the Security page, not in a public issue.
ضع درعاً أمام تطبيقاتك اليوم
ثبّته على خادمك الخاص، أو راسلنا للحديث عن التراخيص.