Tell humans from automation
Every request gets a score from 0 (human) to 100 (automation), the sum of signals that the event details: user agent, TLS fingerprint, header coherence, address reputation, rate.
Bot management and anti-bot
An explainable bot score, challenges that do not bother humans, verified crawlers, a policy for AI crawlers and an « Under attack » mode. Your tools (git, curl, installers, API calls) are not stopped by the browser challenge.
Where to find it in the console : Protection menu: Bots and Rate limit; the red « Under attack » button in the top bar.
What it is for
Respond in proportion
Log, challenge, slow down or block according to the score, with thresholds you set. A visitor who passes a challenge gets a cookie and is left alone.
Keep the good crawlers
Googlebot and the other search crawlers are recognised by reverse DNS, a fake one is blocked. AI crawlers have a policy of their own.
Do not break your tools
git, curl, installers and API calls cannot pass a browser challenge. They are exempt by default, even in Under attack mode.
From score to action
The anti-bot module is off by default: you switch it on site by site. Its default mode is « graduated ».
A score from 0 to 100
A scanner user agent, a denied TLS fingerprint, a fake crawler or a badly reputed address raise the score. A valid clearance cookie lowers it.
A graduated action
By default: log from 30, challenge from 60, slow down from 80, block from 90. The modes are off, detection (score and log only), always challenge, or graduated.
A clearance cookie
After a passed challenge, the visitor gets a signed cookie, tied to their address, valid for one hour by default.
Challenges that respect privacy
Gratuito
The challenge is an interstitial page available in ten languages.
- Invisible proof of work (default): the browser solves a small computation and reports signs of automation, without asking the person anything.
- A JavaScript check without computation, or a built-in vector-image CAPTCHA (distorted characters or a small sum) whose answer never leaves the server.
- Cloudflare Turnstile, hCaptcha or reCAPTCHA as an explicit option: the visitor's address then goes to the provider and its script is loaded in the browser.
- Without a valid key, the site falls back to proof of work. If the provider is unreachable, the visitor stays on the challenge, or gets through according to your setting.
Non ancora provata in condizioni realiThe real Turnstile, hCaptcha and reCAPTCHA services have never been tried. Open your site in a private window to check the challenge before relying on it.
Verified crawlers
Gratuito
A crawler that claims to be Googlebot is confirmed by forward-confirmed reverse DNS, or by published address ranges.
- The built-in list covers Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot, Baiduspider, Slurp and the crawlers of Facebook, X and LinkedIn.
- A crawler that claims to be one and fails verification is blocked as a spoof.
AI crawlers
Gratuito
A policy per site: allow, log (default), challenge or block, with a list of exceptions.
- The built-in list covers GPTBot, ClaudeBot, PerplexityBot, CCBot, Bytespider, Amazonbot and others.
- You can allow a partner and block the rest, crawler by crawler.
Under attack mode
Gratuito
A switch that makes every visitor pass a challenge before reaching your sites, for as long as the attack lasts.
- The « Under attack » button in the top bar applies to every site at once, after confirmation. It is reserved to platform administrators and turns itself off after two hours.
- Through the API, the mode can also target a few sites only, with a duration of your choice.
- All visitors are challenged (proof of work), except those who already hold a valid clearance cookie, verified search engines, the addresses of your allow list and exempt programmatic clients.
- Flood detection can also turn it on by itself (off by default), with a cool-down of 300 seconds by default.
Programmatic clients are not challenged
Gratuito
A program cannot pass a browser challenge. Before, a git clone, a download or a panel's Git deployment got a 403 error on the « Checking your browser » page. These clients are now exempt by default from the challenge imposed on every visitor: in « always challenge » mode as in Under attack mode.
- A request is exempt if its path matches (by default Git paths such as git-upload-pack, GitLab raw files and /api/), if its user agent starts with git, curl, wget, Go-http-client, python-requests (or contains PowerShell), or if it carries an Authorization or PRIVATE-TOKEN header.
- The three lists are set per site, and a single setting (ANTIBOT_EXEMPT_API) turns the exemption off to challenge programs like browsers.
- The exemption only skips the challenge: attack rules, rate limits, address reputation and access lists apply to these requests like any other.
- It is not authentication: a user agent and a header are typed by hand. If your site relies on the challenge for a path under /api/, narrow the path list or turn the exemption off for that site.
- Nodes must run the version that contains this exemption; an older node still challenges paths and headers.
Logins, sign-ups and fingerprints
Gratuito
More targeted protections against abuse.
- Limits on login paths (10 attempts in 300 seconds by default), on one-time codes (5 per hour by default) and credential-stuffing detection.
- Sign-ups refused with a disposable e-mail address (off by default).
- JA3 and JA4 TLS fingerprints when ToutWAF terminates TLS: refusal of known tools, rate limit per fingerprint, coherence check with the user agent.
- Detection of headless browsers during the challenge.
What is not done, or not proven
We prefer to say it plainly.
- The external CAPTCHA services are implemented but have never been tried with the real providers.
- Not done: behavioural biometrics, detection of account takeover and card testing, detection of content scraping or stock hoarding, and leaked-password checks.
- ToutWAF handles layer-7 floods up to what a node can process; it is not a volumetric (layer 3 and 4) scrubbing service. Keep your provider's protection in front of it.
- Limit counters live in the memory of each node: with several nodes, the effective limit per client is roughly multiplied by their number, unless the balancer pins a client to a node.
Use cases
A shop targeted by credential stuffing
A limit on the login page, detection of many accounts tried from one client, a challenge for high scores.
An attack in progress
One click on « Under attack »: every visitor passes a challenge, your Git deployments and API calls carry on.
Decide about AI crawlers
You allow a partner, log the others for a month, then decide whether to challenge or block them.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
Non ancora provata in condizioni reali Funziona nei test del prodotto, ma non è ancora stata provata con il servizio, il sistema o l'apparecchiatura reali. La console mostra la stessa nota dove configuri la funzione.
Bot, abusi e traffico di IA
- Punteggio bot spiegabile da 0 a 100, utilizzabile nelle regole e visibile negli eventiGratuito
- Azioni graduate: registrare, sfidare, rallentare, esca, bloccareGratuito
- Proof-of-work invisibile, controllo JavaScript o CAPTCHA integrato rispettoso della privacyGratuito
- Cloudflare Turnstile, hCaptcha o reCAPTCHA come opzione esplicita (l'indirizzo del visitatore va allora al fornitore) Non ancora provata in condizioni realiGratuito
- Crawler verificati tramite DNS inverso: un falso Googlebot viene bloccatoGratuito
- Policy per i crawler di IA (GPTBot, ClaudeBot e altri): consentire, registrare, sfidare o bloccareGratuito
- Impronte TLS JA3 e JA4, utilizzabili per negare strumenti e limitare la frequenzaGratuito
- Coerenza degli header: user-agent, impronta TLS, ordine degli headerGratuito
- Segnali di browser headless, controllati durante la sfidaGratuito
- Limiti su accessi, codici monouso e credential stuffingGratuito
- Iscrizioni con indirizzi e-mail usa e getta rifiutateGratuito
Anti-DDoS di livello 7 e limitazione della frequenza
- Interruttore globale «sotto attacco» con un clic, dalla barra in altoGratuito
- Rilevamento adattivo delle inondazioni e modalità sotto attacco automaticaGratuito
Tornare al valore predefinito di un'opzione avanzata è sempre possibile. Che cosa accade alla fine di una licenza a pagamento è descritto nelle domande frequenti sui prezzi: 48 ore di tolleranza, 48 ore di sola lettura, poi la protezione WAF viene disattivata fino al rinnovo.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.