Self-hosted, data residency
Traffic and logs stay on your infrastructure, in the jurisdiction you choose. No mandatory cloud, no telemetry; the few outgoing connections (updates, definitions, certificates) are listed in the documentation.
WAAP · Linux · Windows · Docker · Kubernetes · x86_64 / ARM64
Complete web and API protection that stops attacks before they reach your apps.
ToutWAF, the self-hosted WAAP platform: WAF, API protection, anti-bot, layer-7 anti-DDoS and client-side security, driven from a single console. It also looks after what surrounds your sites: servers (live dashboards, security audit, one-click fixes), endpoint antivirus and a mail gateway. Detection mode first, blocking when you are ready.
- Self-hosted
- 10 languages
- Your data stays with you
AttacksLegitimate traffic
Your app
' OR 1=1--
../../etc/passwd
GET /api/orders
200 OK
BLOCKEDALLOWED
- 29domains of protection and operations
- 10languages, including RTL
- 85sources of rules and threat intelligence
- 0telemetry by default
Compatible with almost every system
Dozens of Linux distributions and versions, Windows, Docker and Kubernetes, on x86_64 and 64-bit ARM.
- AlmaLinux10 · 9 · 8
- Rocky Linux10 · 9 · 8
- Red Hat Enterprise Linux10 · 9 · 8
- CentOS Stream10 · 9
- Oracle Linux10 · 9 · 8
- Fedora44 · 43 · 42 · 41
- Amazon Linux2023
- Debian13 · 12 · 11
- Ubuntu26.04 · 25.10 · 24.04 · 22.04 · 20.04
- Kali Linuxrolling
- openSUSE Leap16.0 · 15.6
- openSUSE Tumbleweedrolling
- openSUSE Slowrollrolling
- SUSE Linux Enterprise Server16.0 · 15.7 · 15.6
- Arch Linuxrolling
- Manjarorolling
- EndeavourOSrolling
- Garuda Linuxrolling
- CachyOSrolling
- Windows11 · 10 · Server 2025 · Server 2022 · Server 2019 · Server 2016
- DockerCompose
- KubernetesHelm · 1.25+
- CPUx86_64 · ARM64
Linux Mint / LMDE, Pop!_OS, Zorin OS, elementary OS
- tested The full container install test passed on this exact version.
- expected Same family, recent enough glibc and systemd, but the full test was not run.
One console, five layers of protection
Stop stitching together a WAF, an API gateway, a bot tool and a DDoS shield. ToutWAF unifies them.
WAF
OWASP Top 10, CRS and SecLang, virtual patching.
API protection
Route profile, JWT, GraphQL limits, discovery; schema validation under licence.
Anti-bot
Fingerprinting, challenges, bot score, AI crawlers.
L7 anti-DDoS
Multi-key rate limits, flood detection, HTTP/2 abuse.
Client-side
CSP generator, third-party script inventory, skimmer patterns.
See it work, live
Every request goes through one pipeline: lists, geo, reputation, limits, anti-bot and signature detection with anomaly scoring.
$ curl -i "https://shop.example.com/?id=1' OR '1'='1" HTTP/2 403 x-toutwaf: blocked x-toutwaf-code: TW-2001 rule: sqli.tautology score 15/5
Live threat map Simulated illustration
Event stream Simulated illustration
- 12:04:51185.220.101.7BAN/?id=1' UNION SELECTsqli
- 12:04:4945.155.205.12BLOCK/wp-login.php (wpscan)bot
- 12:04:46103.74.19.88BLOCK/download?f=../../etc/passwdlfi
- 12:04:4491.240.118.9BLOCK/q?s=<img onerror=x>xss
- 12:04:40194.26.29.55BLOCK/api/login x 240/minrate
Everything a modern WAAP should do
From signature detection to server, endpoint and mail security: every function says whether it is free or needs a licence. No cloud lock-in.
Application protection
Injections, deserialization, request smuggling, uploads, scanners and CMS attacks, inspected on every request in detection or blocking mode.
API security
A route profile in learning mode first, OWASP API Top 10 coverage, tokens, keys and GraphQL limits; schema validation and consumer plans under licence.
Bots, abuse and AI traffic
An explainable bot score, challenges, verified crawlers, TLS fingerprints, an AI crawler policy and abuse limits.
L7 DDoS and rate limiting
Limits per key, flood detection, an under-attack mode and connection guards against slow attacks and HTTP/2 abuse.
Access control and IP reputation
Lists, countries, reputation and automatic bans; country degrees, thresholds and simulation under licence.
Automatic rules
ToutWAF settles its own false positives and moves a site from observation to blocking, with evidence you can audit and undo.
Tenants and MSPs
Run ToutWAF for several clients from one console: one organisation per client, quotas, isolation, invitations and reports per client. The default organisation is free, the rest is under licence.
Servers and host agents
Add your existing servers and watch over them from the same console, with a small agent for Linux and Windows that only opens outbound connections.
Backups and standby console
Back up the console and the servers you supervise, with restore tests; a standby console takes over when you decide.
Mail security gateway
A Postfix and Rspamd gateway that ToutWAF installs and manages over SSH on a server of yours, in front of your real mail server. No free tier.
Console and languages
A customisable console in 10 languages, including right-to-left Arabic, reached under a secret path.
Protected in three steps
Install
The installer checks your system first. One command on a supported Linux, a script on Windows, or the Docker and Kubernetes files.
Add your site
Enter the domain and the origin. ToutWAF gets the certificate, detects your stack and proposes a policy template.
Watch, then block
Detection mode runs first. Review the report, switch to blocking in one click, and roll back in one click too.
Fewer false positives, by method
Observe first, block when it is proven
A WAF that blocks the wrong requests costs more than it protects. ToutWAF starts in detection mode, shows what it would have blocked, lets you test a change on past traffic and explains every decision. It cannot promise zero false positives, and no figure is published for it.
Observe
Detection mode is the default. At the end of the observation period a report proposes narrow exceptions for the recurring false positives.
Simulate
Replay recorded traffic against a draft policy and see what it would have blocked.
Block step by step
Switch to blocking in one click, or roll it out on a share of nodes or requests first, and roll back in one step.
403Request blocked (example)
TW-2001- What
- SQL injection attempt
- Where
- Query parameter id on /product
- Why
- The value contains ' OR '1'='1, a classic always-true condition. Rule sqli.tautology, score 15 (threshold 5).
This is a false positiveCreate the narrowest exception
Impact preview: 0.01% of the last 7 days of traffic would be affected.
Detection report after 7 days (example)
- ✓99.8% of traffic would be allowed
- !3 rules cause 95% of false positives
- ✓3 exceptions proposed, ready to review
Sovereign by design: your traffic, your servers, your rules
Built for organisations that must keep control of their data.
Privacy controls
IP pseudonymisation, log minimisation, masked payload capture, configurable retention, and export or erasure by address.
Compliance evidence, no certification
A verifiable audit trail and evidence mapped to controls (PCI DSS 4.0, NIS2, DORA, ISO 27001, SOC 2) from the live state of the platform. It is evidence, not an attestation: ToutWAF holds no certification.
Protect your sites and look after the servers behind them
Real screenshots of the console: live dashboards, security score A to F, one-click fixes and a look you can make your own.
A console your team will enjoy
The ToutWAF console gives you full control: live attacks, explained events, sites, rules, bans and certificates, with seven themes, light and dark modes and a layout that works on a phone. Illustration with demonstration data.
https://waf.example.com:9443
192.168.4.2 web.local AlmaLinux 10.2FR
Dashboard
Requests1.2M/ 24h
Blocked14 3801.2%
CPU12 / 122296 MHz
RAM1.6 / 63 GBtoutwaf-dp 0.3.0-dev
Requests / Blocked
To watch2
Two-factor authentication inactiveEnable 2FA to protect console access.
1 site without certificateLet's Encrypt is free and automatic.
Put a shield in front of your applications today
Install it on your own server, or get in touch to talk about licences.