Tell humans from automation
Every request gets a score from 0 (human) to 100 (automation), the sum of signals that the event details: user agent, TLS fingerprint, header coherence, address reputation, rate.
Bot management and anti-bot
An explainable bot score, challenges that do not bother humans, verified crawlers, a policy for AI crawlers and an « Under attack » mode. Your tools (git, curl, installers, API calls) are not stopped by the browser challenge.
Where to find it in the console : Protection menu: Bots and Rate limit; the red « Under attack » button in the top bar.
What it is for
Respond in proportion
Log, challenge, slow down or block according to the score, with thresholds you set. A visitor who passes a challenge gets a cookie and is left alone.
Keep the good crawlers
Googlebot and the other search crawlers are recognised by reverse DNS, a fake one is blocked. AI crawlers have a policy of their own.
Do not break your tools
git, curl, installers and API calls cannot pass a browser challenge. They are exempt by default, even in Under attack mode.
From score to action
The anti-bot module is off by default: you switch it on site by site. Its default mode is « graduated ».
A score from 0 to 100
A scanner user agent, a denied TLS fingerprint, a fake crawler or a badly reputed address raise the score. A valid clearance cookie lowers it.
A graduated action
By default: log from 30, challenge from 60, slow down from 80, block from 90. The modes are off, detection (score and log only), always challenge, or graduated.
A clearance cookie
After a passed challenge, the visitor gets a signed cookie, tied to their address, valid for one hour by default.
Challenges that respect privacy
Gratis
The challenge is an interstitial page available in ten languages.
- Invisible proof of work (default): the browser solves a small computation and reports signs of automation, without asking the person anything.
- A JavaScript check without computation, or a built-in vector-image CAPTCHA (distorted characters or a small sum) whose answer never leaves the server.
- Cloudflare Turnstile, hCaptcha or reCAPTCHA as an explicit option: the visitor's address then goes to the provider and its script is loaded in the browser.
- Without a valid key, the site falls back to proof of work. If the provider is unreachable, the visitor stays on the challenge, or gets through according to your setting.
Nog niet onder echte omstandigheden getestThe real Turnstile, hCaptcha and reCAPTCHA services have never been tried. Open your site in a private window to check the challenge before relying on it.
Verified crawlers
Gratis
A crawler that claims to be Googlebot is confirmed by forward-confirmed reverse DNS, or by published address ranges.
- The built-in list covers Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot, Baiduspider, Slurp and the crawlers of Facebook, X and LinkedIn.
- A crawler that claims to be one and fails verification is blocked as a spoof.
AI crawlers
Gratis
A policy per site: allow, log (default), challenge or block, with a list of exceptions.
- The built-in list covers GPTBot, ClaudeBot, PerplexityBot, CCBot, Bytespider, Amazonbot and others.
- You can allow a partner and block the rest, crawler by crawler.
Under attack mode
Gratis
A switch that makes every visitor pass a challenge before reaching your sites, for as long as the attack lasts.
- The « Under attack » button in the top bar applies to every site at once, after confirmation. It is reserved to platform administrators and turns itself off after two hours.
- Through the API, the mode can also target a few sites only, with a duration of your choice.
- All visitors are challenged (proof of work), except those who already hold a valid clearance cookie, verified search engines, the addresses of your allow list and exempt programmatic clients.
- Flood detection can also turn it on by itself (off by default), with a cool-down of 300 seconds by default.
Programmatic clients are not challenged
Gratis
A program cannot pass a browser challenge. Before, a git clone, a download or a panel's Git deployment got a 403 error on the « Checking your browser » page. These clients are now exempt by default from the challenge imposed on every visitor: in « always challenge » mode as in Under attack mode.
- A request is exempt if its path matches (by default Git paths such as git-upload-pack, GitLab raw files and /api/), if its user agent starts with git, curl, wget, Go-http-client, python-requests (or contains PowerShell), or if it carries an Authorization or PRIVATE-TOKEN header.
- The three lists are set per site, and a single setting (ANTIBOT_EXEMPT_API) turns the exemption off to challenge programs like browsers.
- The exemption only skips the challenge: attack rules, rate limits, address reputation and access lists apply to these requests like any other.
- It is not authentication: a user agent and a header are typed by hand. If your site relies on the challenge for a path under /api/, narrow the path list or turn the exemption off for that site.
- Nodes must run the version that contains this exemption; an older node still challenges paths and headers.
Logins, sign-ups and fingerprints
Gratis
More targeted protections against abuse.
- Limits on login paths (10 attempts in 300 seconds by default), on one-time codes (5 per hour by default) and credential-stuffing detection.
- Sign-ups refused with a disposable e-mail address (off by default).
- JA3 and JA4 TLS fingerprints when ToutWAF terminates TLS: refusal of known tools, rate limit per fingerprint, coherence check with the user agent.
- Detection of headless browsers during the challenge.
What is not done, or not proven
We prefer to say it plainly.
- The external CAPTCHA services are implemented but have never been tried with the real providers.
- Not done: behavioural biometrics, detection of account takeover and card testing, detection of content scraping or stock hoarding, and leaked-password checks.
- ToutWAF handles layer-7 floods up to what a node can process; it is not a volumetric (layer 3 and 4) scrubbing service. Keep your provider's protection in front of it.
- Limit counters live in the memory of each node: with several nodes, the effective limit per client is roughly multiplied by their number, unless the balancer pins a client to a node.
Use cases
A shop targeted by credential stuffing
A limit on the login page, detection of many accounts tried from one client, a challenge for high scores.
An attack in progress
One click on « Under attack »: every visitor passes a challenge, your Git deployments and API calls carry on.
Decide about AI crawlers
You allow a partner, log the others for a month, then decide whether to challenge or block them.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Nog niet onder echte omstandigheden getest Werkt in de tests van het product, maar is nog niet geprobeerd met de echte dienst, het echte systeem of de echte apparatuur. De console toont dezelfde opmerking waar u de functie instelt.
Bots, misbruik en AI-verkeer
- Verklaarbare botscore van 0 tot 100, bruikbaar in regels en zichtbaar in gebeurtenissenGratis
- Gradueel optreden: loggen, challenge, vertragen, lokaas, blokkerenGratis
- Onzichtbare proof-of-work, JavaScript-controle of ingebouwde privacyvriendelijke CAPTCHAGratis
- Cloudflare Turnstile, hCaptcha of reCAPTCHA als expliciete optie (het adres van de bezoeker gaat dan naar de aanbieder) Nog niet onder echte omstandigheden getestGratis
- Crawlers geverifieerd via reverse DNS: een valse Googlebot wordt geblokkeerdGratis
- Beleid voor AI-crawlers (GPTBot, ClaudeBot en andere): toestaan, loggen, challenge of blokkerenGratis
- TLS-vingerafdrukken JA3 en JA4, bruikbaar om tools te weigeren en snelheid te beperkenGratis
- Coherentie van headers: user-agent, TLS-vingerafdruk, volgorde van headersGratis
- Signalen van headless browsers, gecontroleerd tijdens de challengeGratis
- Limieten op aanmeldingen, eenmalige codes en credential stuffingGratis
- Aanmeldingen met wegwerp-e-mailadressen worden geweigerdGratis
Laag-7-anti-DDoS en snelheidsbeperking
- Globale aanvalsschakelaar met één klik, in de bovenbalkGratis
- Adaptieve floodherkenning en automatische aanvalsmodusGratis
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.