Tell humans from automation
Every request gets a score from 0 (human) to 100 (automation), the sum of signals that the event details: user agent, TLS fingerprint, header coherence, address reputation, rate.
Bot management and anti-bot
An explainable bot score, challenges that do not bother humans, verified crawlers, a policy for AI crawlers and an « Under attack » mode. Your tools (git, curl, installers, API calls) are not stopped by the browser challenge.
Where to find it in the console : Protection menu: Bots and Rate limit; the red « Under attack » button in the top bar.
What it is for
Respond in proportion
Log, challenge, slow down or block according to the score, with thresholds you set. A visitor who passes a challenge gets a cookie and is left alone.
Keep the good crawlers
Googlebot and the other search crawlers are recognised by reverse DNS, a fake one is blocked. AI crawlers have a policy of their own.
Do not break your tools
git, curl, installers and API calls cannot pass a browser challenge. They are exempt by default, even in Under attack mode.
From score to action
The anti-bot module is off by default: you switch it on site by site. Its default mode is « graduated ».
A score from 0 to 100
A scanner user agent, a denied TLS fingerprint, a fake crawler or a badly reputed address raise the score. A valid clearance cookie lowers it.
A graduated action
By default: log from 30, challenge from 60, slow down from 80, block from 90. The modes are off, detection (score and log only), always challenge, or graduated.
A clearance cookie
After a passed challenge, the visitor gets a signed cookie, tied to their address, valid for one hour by default.
Challenges that respect privacy
Kostenlos
The challenge is an interstitial page available in ten languages.
- Invisible proof of work (default): the browser solves a small computation and reports signs of automation, without asking the person anything.
- A JavaScript check without computation, or a built-in vector-image CAPTCHA (distorted characters or a small sum) whose answer never leaves the server.
- Cloudflare Turnstile, hCaptcha or reCAPTCHA as an explicit option: the visitor's address then goes to the provider and its script is loaded in the browser.
- Without a valid key, the site falls back to proof of work. If the provider is unreachable, the visitor stays on the challenge, or gets through according to your setting.
Noch nicht unter realen Bedingungen erprobtThe real Turnstile, hCaptcha and reCAPTCHA services have never been tried. Open your site in a private window to check the challenge before relying on it.
Verified crawlers
Kostenlos
A crawler that claims to be Googlebot is confirmed by forward-confirmed reverse DNS, or by published address ranges.
- The built-in list covers Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot, Baiduspider, Slurp and the crawlers of Facebook, X and LinkedIn.
- A crawler that claims to be one and fails verification is blocked as a spoof.
AI crawlers
Kostenlos
A policy per site: allow, log (default), challenge or block, with a list of exceptions.
- The built-in list covers GPTBot, ClaudeBot, PerplexityBot, CCBot, Bytespider, Amazonbot and others.
- You can allow a partner and block the rest, crawler by crawler.
Under attack mode
Kostenlos
A switch that makes every visitor pass a challenge before reaching your sites, for as long as the attack lasts.
- The « Under attack » button in the top bar applies to every site at once, after confirmation. It is reserved to platform administrators and turns itself off after two hours.
- Through the API, the mode can also target a few sites only, with a duration of your choice.
- All visitors are challenged (proof of work), except those who already hold a valid clearance cookie, verified search engines, the addresses of your allow list and exempt programmatic clients.
- Flood detection can also turn it on by itself (off by default), with a cool-down of 300 seconds by default.
Programmatic clients are not challenged
Kostenlos
A program cannot pass a browser challenge. Before, a git clone, a download or a panel's Git deployment got a 403 error on the « Checking your browser » page. These clients are now exempt by default from the challenge imposed on every visitor: in « always challenge » mode as in Under attack mode.
- A request is exempt if its path matches (by default Git paths such as git-upload-pack, GitLab raw files and /api/), if its user agent starts with git, curl, wget, Go-http-client, python-requests (or contains PowerShell), or if it carries an Authorization or PRIVATE-TOKEN header.
- The three lists are set per site, and a single setting (ANTIBOT_EXEMPT_API) turns the exemption off to challenge programs like browsers.
- The exemption only skips the challenge: attack rules, rate limits, address reputation and access lists apply to these requests like any other.
- It is not authentication: a user agent and a header are typed by hand. If your site relies on the challenge for a path under /api/, narrow the path list or turn the exemption off for that site.
- Nodes must run the version that contains this exemption; an older node still challenges paths and headers.
Logins, sign-ups and fingerprints
Kostenlos
More targeted protections against abuse.
- Limits on login paths (10 attempts in 300 seconds by default), on one-time codes (5 per hour by default) and credential-stuffing detection.
- Sign-ups refused with a disposable e-mail address (off by default).
- JA3 and JA4 TLS fingerprints when ToutWAF terminates TLS: refusal of known tools, rate limit per fingerprint, coherence check with the user agent.
- Detection of headless browsers during the challenge.
What is not done, or not proven
We prefer to say it plainly.
- The external CAPTCHA services are implemented but have never been tried with the real providers.
- Not done: behavioural biometrics, detection of account takeover and card testing, detection of content scraping or stock hoarding, and leaked-password checks.
- ToutWAF handles layer-7 floods up to what a node can process; it is not a volumetric (layer 3 and 4) scrubbing service. Keep your provider's protection in front of it.
- Limit counters live in the memory of each node: with several nodes, the effective limit per client is roughly multiplied by their number, unless the balancer pins a client to a node.
Use cases
A shop targeted by credential stuffing
A limit on the login page, detection of many accounts tried from one client, a challenge for high scores.
An attack in progress
One click on « Under attack »: every visitor passes a challenge, your Git deployments and API calls carry on.
Decide about AI crawlers
You allow a partner, log the others for a month, then decide whether to challenge or block them.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditionKostenlos In allen Angeboten enthalten, auch in den beiden kostenlosen (Free und Free +)Pro und höher Kostenpflichtige Angebote: in der Konsole sichtbar, ohne Lizenz gesperrt. Ab Pro, sofern nicht Agency oder Enterprise angegeben ist
Noch nicht unter realen Bedingungen erprobt Funktioniert in den Tests des Produkts, wurde aber noch nicht mit dem echten Dienst, System oder Gerät erprobt. Die Konsole zeigt denselben Hinweis dort, wo Sie die Funktion einrichten.
Bots, Missbrauch und KI-Verkehr
- Erklärbarer Bot-Score von 0 bis 100, in Regeln nutzbar und in Ereignissen sichtbarKostenlos
- Abgestufte Aktionen: protokollieren, Challenge, Tarpit, Köder, blockierenKostenlos
- Unsichtbarer Proof-of-Work, JavaScript-Prüfung oder integriertes, datenschutzfreundliches CAPTCHAKostenlos
- Cloudflare Turnstile, hCaptcha oder reCAPTCHA als ausdrückliche Option (die Adresse des Besuchers geht dann an den Anbieter) Noch nicht unter realen Bedingungen erprobtKostenlos
- Crawler per Reverse-DNS verifiziert: ein falscher Googlebot wird blockiertKostenlos
- Richtlinie für KI-Crawler (GPTBot, ClaudeBot und andere): erlauben, protokollieren, Challenge oder blockierenKostenlos
- TLS-Fingerabdrücke JA3 und JA4, nutzbar zum Sperren von Werkzeugen und zur RatenbegrenzungKostenlos
- Header-Kohärenz: User-Agent, TLS-Fingerabdruck, Reihenfolge der HeaderKostenlos
- Signale von Headless-Browsern, während der Challenge geprüftKostenlos
- Limits für Anmeldungen, Einmalcodes und Credential StuffingKostenlos
- Registrierungen mit Wegwerf-E-Mail-Adressen werden abgelehntKostenlos
Layer-7-Anti-DDoS und Ratenbegrenzung
- Globaler Angriffsschalter mit einem Klick, in der oberen LeisteKostenlos
- Adaptive Flood-Erkennung und automatischer AngriffsmodusKostenlos
Zum Standardwert einer erweiterten Option zurückzukehren ist immer möglich. Was am Ende einer kostenpflichtigen Lizenz geschieht, steht in den FAQ zu den Preisen: 48 Stunden Karenzzeit, 48 Stunden Nur-Lesen, danach WAF-Schutz aus bis zur Verlängerung.
Stellen Sie noch heute einen Schild vor Ihre Anwendungen
Installieren Sie es auf Ihrem eigenen Server oder schreiben Sie uns, um über Lizenzen zu sprechen.