Free + offer: free with sign-up
More sites and requests than Free, professional use included. What is included, what is not, the limits and the terms, before you order.
Free +
For those who need a little more than Free without paying: a free account, a licence sent by e-mail.
No payment, no bank card.
Free, professional use included, within the limits. The licence is created when you confirm the order and sent by e-mail.
At a glance
- 5 protected sites
- 1 WAF node
- 2 users
- 1 organisation
- 15 million requests per month
- Community support
The ceilings apply to the whole offer (all your servers together), not to each server.
Quotas and limits
Every ceiling of the offer, one by one.
- Protected sites
- 5
- WAF nodes
- 1
- Users
- 2
- Organisations
- 1
- Allowed requests per month
- 15 million requests per month
- Event retention
- 30 days by default, adjustable by the administrator; the offer sets no duration
- Support
- Community support
- Licence
- Free licence, sent by e-mail
Only allowed requests are counted. Warning at 80% then 100% of the quota; going over never cuts protection or traffic.
What is included
In every offer, the free ones included:
- WAF protection
- Two-factor authentication
- Security updates
Every function marked “Free” on the Features page: detectors, rules, bots, TLS, basic load balancing, logs and many more.
Free + keeps everything Free offers, with higher ceilings (see the quotas). No function reserved for the paid offers is included.
Works in the product's tests, but has not yet been tried with the real service, system or equipment. The console shows the same note where you set the function up.
What is not included
To decide with full knowledge, here is what this offer does not include:
- No function reserved for the paid offers (see the list below).
- No priority support: community support only.
- No multi-client management: 1 organisation and 2 users.
Functions reserved for a higher offer (66):
Automatic rules
- Site self-test: ordinary requests evaluated through your data plane before anything is blocked
- Estimated false-positive rate per rule group and the Ready to block indicator
- Journal of automatic decisions with the evidence, and one-click undo
- Automatic profile: log only, then challenge, then block, one rule group at a time
- Automatic exceptions: narrow, expiring, created only from strong evidence in real traffic
- Automatic rollback of a rule update that blocks ordinary requests
Definitions and threat intelligence
- Pro and Maximum packages: broader address lists, phishing domains, AS table, City table
- Precision of each list measured on your own traffic
- Adjustable points for each reputation class
- Weekly watcher of public registries that proposes new sources and flags dead ones
- Your own keys for lists that need one, stored encrypted
API security
- Specification import and validation of requests and responses: OpenAPI 3, Swagger 2, GraphQL SDL, gRPC proto
- BOLA: identifiers never given to this client, learned from traffic
- Test my protection with harmless attacks, simulation on past traffic, profile import
- Consumers, plans and quotas, private usage pages, limits per key or per user
- Signed incoming webhooks: Stripe, GitHub, GitLab, Slack, Shopify, Twilio and generic HMAC
Access control and IP reputation
- Six degrees per country: normal, watch, harden, challenge, restrict, block
- Scopes by path, method and hours; expiring rules; reputation thresholds per country
- Own degree for Tor, VPN and hosting addresses and for chosen ASNs
- Simulation of a geographic policy on past traffic
- External IP lists refreshed automatically
- Kernel blocking (nftables) of the very large lists, on the host of the control plane Not yet tried in real conditions
TLS and certificates
- Several authorities with automatic failover, paid and internal ACME directories Not yet tried in real conditions
Anomaly detection, AI assistant and LLM protection
- Private language model on your own server (Ollama or OpenAI-compatible): no question leaves your network Not yet tried in real conditions
Traffic delivery and load balancing
- Other algorithms: least connections, IP hash, consistent hash, random, two choices, fastest
- Session persistence by cookie, address or header
- Active health checks and fine tuning of the circuit breaker
- Maintenance of a server or a node without cutting a single request (drain)
- Canary and blue/green rollouts by share of requests, and slow start
Analytics
- Advanced analytics: conversion funnels, retention cohorts, map down to the city, traffic alerts, scheduled reports by e-mail (PDF or CSV)
Servers and host agents
- More than one protection node, installed and kept in step from the console
Server monitoring
- Rules and thresholds of your own, for the measures you choose
- More than one supervised server
- More than 3 availability probes
- Host security: inventory of packages, accounts, SSH keys and scheduled tasks, with a vulnerability lookup done on your console (your package list never leaves it)
- Integrity of the files you choose and 25 read-only hardening checks
Backups and standby console
- Off-site targets: S3, SFTP, WebDAV or a command
- Backup server: files and databases (MySQL, MariaDB, PostgreSQL) of supervised servers, encrypted with a recovery key only you keep, verified by a restore test
- Standby console: an encrypted, verified copy every hour and a guided, manual takeover Not yet tried in real conditions
Mail security gateway
- Inbound gateway in front of your mail server, installed and managed over SSH on a dedicated Linux server Not yet tried in real conditions
- Anti-spam and anti-phishing, attachment policy, optional antivirus, quarantine Not yet tried in real conditions
- Data-loss prevention on messages Not yet tried in real conditions
- Sender verification (SPF, DKIM, DMARC), greylisting, impersonation and link detection: all off by default Not yet tried in real conditions
- Never an open relay: every configuration is checked; if the filter stops, mail is held, not lost Not yet tried in real conditions
- Optional outgoing mail: relay, DKIM signing, sending limits Not yet tried in real conditions
- Mail doctor, daily digest of the quarantine, reports and exports Not yet tried in real conditions
- Nothing about your mail goes to a third party by default; message content is never in the audit log Not yet tried in real conditions
Tenants and MSPs
- Add a client wizard: client, quotas, first user, report brand, isolation check and handover
- Strict isolation between clients, checked by tests on every family of routes
- Quotas per client (sites, users); the monthly volume of requests is measured and never cuts traffic
- Client selector and a multi-client overview with the protection state of each client
- Suspend, archive, export and delete a client; reactivating, exporting and deleting are never locked
- Moving a site from one client to another
- A policy floor imposed from above
- Invitations by single-use link: no password is ever sent
- PDF reports per client, scheduled; usage export in CSV for your own invoicing
- The client's name, logo, colours and support contact on its reports, next to ToutWAF and never in its place
- Reseller licence: one pool of quotas shared by all your clients
Administration and access
- Audit log exports in CEF and Syslog for a SIEM
- Enterprise sign-in: OIDC and SAML providers and SCIM provisioning Not yet tried in real conditions
Integrations
- SIEM and logs: Syslog (CEF, LEEF, JSON), Splunk, Elastic and OpenSearch, Microsoft Sentinel, QRadar, ArcSight, Wazuh, Graylog, Datadog, Loki, OpenTelemetry Not yet tried in real conditions
- More chat and paging: Discord, Google Chat, Mattermost, Telegram, ntfy, Pushover, Rocket.Chat, Webex, Zulip, Gotify
- Ticketing: Jira, GLPI, ServiceNow, GitHub and GitLab Issues, Linear, Redmine, Zendesk Not yet tried in real conditions
- SOAR and automation: n8n, Shuffle, Zapier, TheHive
- Threat intelligence: MISP in both directions, STIX/TAXII (OpenCTI and others), CrowdSec
- Git link (off by default, experimental): the configuration lives in a Git repository, ToutWAF computes a plan and applies it after checks Not yet tried in real conditions
ToutWAF does not advertise what does not exist: the endpoint antivirus is not offered in any plan for now.
Support
Community support
Documentation and community help, with no response-time commitment and no warranty.
Licence cycle
Free + has no locking expiry cycle.
- If the Free + licence expires or is revoked, the installation simply falls back to the limits of Free.
- Nothing is cut or locked; going over the request quota remains a simple warning.
Billing and payment
- No payment and no bank card: the Free + licence is free.
- Your e-mail address and details are used to create the licence and send it to you (see the privacy policy).
Frequently asked questions
How do I receive my licence?
As soon as the order is confirmed (and paid, for a paid offer), the signed licence key is sent by e-mail to the order address. You paste it in the console (Administration > Fleet and licence): it is checked on your machine, with no network call.
Can I change offer later?
Yes: order the offer you want, the new key replaces the previous one in the console. To take the period already paid into account, write to us from the Contact page.
What happens if I reach a ceiling?
The console refuses to create an item beyond the ceiling (error TW-8008, which says what limits and what to do); what already exists keeps working. Move to the next offer for more capacity.
Why an order, if it is free?
The order creates your Free + licence: we send you the key by e-mail, with no payment. It replaces the limits of Free (the quotas are not added up).
Choose Free +
A cart, a form, and your licence arrives by e-mail.