Tell humans from automation
Every request gets a score from 0 (human) to 100 (automation), the sum of signals that the event details: user agent, TLS fingerprint, header coherence, address reputation, rate.
Bot management and anti-bot
An explainable bot score, challenges that do not bother humans, verified crawlers, a policy for AI crawlers and an « Under attack » mode. Your tools (git, curl, installers, API calls) are not stopped by the browser challenge.
Where to find it in the console : Protection menu: Bots and Rate limit; the red « Under attack » button in the top bar.
What it is for
Respond in proportion
Log, challenge, slow down or block according to the score, with thresholds you set. A visitor who passes a challenge gets a cookie and is left alone.
Keep the good crawlers
Googlebot and the other search crawlers are recognised by reverse DNS, a fake one is blocked. AI crawlers have a policy of their own.
Do not break your tools
git, curl, installers and API calls cannot pass a browser challenge. They are exempt by default, even in Under attack mode.
From score to action
The anti-bot module is off by default: you switch it on site by site. Its default mode is « graduated ».
A score from 0 to 100
A scanner user agent, a denied TLS fingerprint, a fake crawler or a badly reputed address raise the score. A valid clearance cookie lowers it.
A graduated action
By default: log from 30, challenge from 60, slow down from 80, block from 90. The modes are off, detection (score and log only), always challenge, or graduated.
A clearance cookie
After a passed challenge, the visitor gets a signed cookie, tied to their address, valid for one hour by default.
Challenges that respect privacy
Gratuito
The challenge is an interstitial page available in ten languages.
- Invisible proof of work (default): the browser solves a small computation and reports signs of automation, without asking the person anything.
- A JavaScript check without computation, or a built-in vector-image CAPTCHA (distorted characters or a small sum) whose answer never leaves the server.
- Cloudflare Turnstile, hCaptcha or reCAPTCHA as an explicit option: the visitor's address then goes to the provider and its script is loaded in the browser.
- Without a valid key, the site falls back to proof of work. If the provider is unreachable, the visitor stays on the challenge, or gets through according to your setting.
Aún no probada en condiciones realesThe real Turnstile, hCaptcha and reCAPTCHA services have never been tried. Open your site in a private window to check the challenge before relying on it.
Verified crawlers
Gratuito
A crawler that claims to be Googlebot is confirmed by forward-confirmed reverse DNS, or by published address ranges.
- The built-in list covers Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot, Baiduspider, Slurp and the crawlers of Facebook, X and LinkedIn.
- A crawler that claims to be one and fails verification is blocked as a spoof.
AI crawlers
Gratuito
A policy per site: allow, log (default), challenge or block, with a list of exceptions.
- The built-in list covers GPTBot, ClaudeBot, PerplexityBot, CCBot, Bytespider, Amazonbot and others.
- You can allow a partner and block the rest, crawler by crawler.
Under attack mode
Gratuito
A switch that makes every visitor pass a challenge before reaching your sites, for as long as the attack lasts.
- The « Under attack » button in the top bar applies to every site at once, after confirmation. It is reserved to platform administrators and turns itself off after two hours.
- Through the API, the mode can also target a few sites only, with a duration of your choice.
- All visitors are challenged (proof of work), except those who already hold a valid clearance cookie, verified search engines, the addresses of your allow list and exempt programmatic clients.
- Flood detection can also turn it on by itself (off by default), with a cool-down of 300 seconds by default.
Programmatic clients are not challenged
Gratuito
A program cannot pass a browser challenge. Before, a git clone, a download or a panel's Git deployment got a 403 error on the « Checking your browser » page. These clients are now exempt by default from the challenge imposed on every visitor: in « always challenge » mode as in Under attack mode.
- A request is exempt if its path matches (by default Git paths such as git-upload-pack, GitLab raw files and /api/), if its user agent starts with git, curl, wget, Go-http-client, python-requests (or contains PowerShell), or if it carries an Authorization or PRIVATE-TOKEN header.
- The three lists are set per site, and a single setting (ANTIBOT_EXEMPT_API) turns the exemption off to challenge programs like browsers.
- The exemption only skips the challenge: attack rules, rate limits, address reputation and access lists apply to these requests like any other.
- It is not authentication: a user agent and a header are typed by hand. If your site relies on the challenge for a path under /api/, narrow the path list or turn the exemption off for that site.
- Nodes must run the version that contains this exemption; an older node still challenges paths and headers.
Logins, sign-ups and fingerprints
Gratuito
More targeted protections against abuse.
- Limits on login paths (10 attempts in 300 seconds by default), on one-time codes (5 per hour by default) and credential-stuffing detection.
- Sign-ups refused with a disposable e-mail address (off by default).
- JA3 and JA4 TLS fingerprints when ToutWAF terminates TLS: refusal of known tools, rate limit per fingerprint, coherence check with the user agent.
- Detection of headless browsers during the challenge.
What is not done, or not proven
We prefer to say it plainly.
- The external CAPTCHA services are implemented but have never been tried with the real providers.
- Not done: behavioural biometrics, detection of account takeover and card testing, detection of content scraping or stock hoarding, and leaked-password checks.
- ToutWAF handles layer-7 floods up to what a node can process; it is not a volumetric (layer 3 and 4) scrubbing service. Keep your provider's protection in front of it.
- Limit counters live in the memory of each node: with several nodes, the effective limit per client is roughly multiplied by their number, unless the balancer pins a client to a node.
Use cases
A shop targeted by credential stuffing
A limit on the login page, detection of many accounts tried from one client, a challenge for high scores.
An attack in progress
One click on « Under attack »: every visitor passes a challenge, your Git deployments and API calls carry on.
Decide about AI crawlers
You allow a partner, log the others for a month, then decide whether to challenge or block them.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiciónGratuito Incluido en todas las ofertas, también en las dos gratuitas (Free y Free +)Pro y superiores Ofertas de pago: visible en la consola, bloqueada sin licencia. Desde Pro, salvo que se indique Agency o Enterprise
Aún no probada en condiciones reales Funciona en las pruebas del producto, pero aún no se ha probado con el servicio, el sistema o el equipo reales. La consola muestra la misma nota donde usted configura la función.
Bots, abusos y tráfico de IA
- Puntuación de bot explicable de 0 a 100, utilizable en las reglas y visible en los eventosGratuito
- Acciones graduales: registrar, desafiar, ralentizar, señuelo, bloquearGratuito
- Prueba de trabajo invisible, comprobación JavaScript o CAPTCHA integrado respetuoso con la privacidadGratuito
- Cloudflare Turnstile, hCaptcha o reCAPTCHA como opción explícita (la dirección del visitante llega entonces al proveedor) Aún no probada en condiciones realesGratuito
- Rastreadores verificados por DNS inverso: un falso Googlebot se bloqueaGratuito
- Política para rastreadores de IA (GPTBot, ClaudeBot y otros): permitir, registrar, desafiar o bloquearGratuito
- Huellas TLS JA3 y JA4, utilizables para denegar herramientas y limitar la tasaGratuito
- Coherencia de las cabeceras: agente de usuario, huella TLS, orden de las cabecerasGratuito
- Señales de navegador sin interfaz (headless), comprobadas durante el desafíoGratuito
- Límites en inicios de sesión, códigos de un solo uso y relleno de credencialesGratuito
- Registros con direcciones de correo desechables rechazadosGratuito
Anti-DDoS de capa 7 y limitación de tasa
- Interruptor global «bajo ataque» con un clic, desde la barra superiorGratuito
- Detección adaptativa de inundaciones y modo bajo ataque automáticoGratuito
Volver al valor por defecto de una opción avanzada siempre es posible. Lo que ocurre al final de una licencia de pago se describe en las preguntas frecuentes de precios: 48 horas de gracia, 48 horas de solo lectura y después la protección WAF se desactiva hasta la renovación.
Precios Read the documentation
Ponga un escudo delante de sus aplicaciones hoy mismo
Instálelo en su propio servidor, o escríbanos para hablar de licencias.