Tell humans from automation
Every request gets a score from 0 (human) to 100 (automation), the sum of signals that the event details: user agent, TLS fingerprint, header coherence, address reputation, rate.
Bot management and anti-bot
An explainable bot score, challenges that do not bother humans, verified crawlers, a policy for AI crawlers and an « Under attack » mode. Your tools (git, curl, installers, API calls) are not stopped by the browser challenge.
Where to find it in the console : Protection menu: Bots and Rate limit; the red « Under attack » button in the top bar.
What it is for
Respond in proportion
Log, challenge, slow down or block according to the score, with thresholds you set. A visitor who passes a challenge gets a cookie and is left alone.
Keep the good crawlers
Googlebot and the other search crawlers are recognised by reverse DNS, a fake one is blocked. AI crawlers have a policy of their own.
Do not break your tools
git, curl, installers and API calls cannot pass a browser challenge. They are exempt by default, even in Under attack mode.
From score to action
The anti-bot module is off by default: you switch it on site by site. Its default mode is « graduated ».
A score from 0 to 100
A scanner user agent, a denied TLS fingerprint, a fake crawler or a badly reputed address raise the score. A valid clearance cookie lowers it.
A graduated action
By default: log from 30, challenge from 60, slow down from 80, block from 90. The modes are off, detection (score and log only), always challenge, or graduated.
A clearance cookie
After a passed challenge, the visitor gets a signed cookie, tied to their address, valid for one hour by default.
Challenges that respect privacy
Gratuito
The challenge is an interstitial page available in ten languages.
- Invisible proof of work (default): the browser solves a small computation and reports signs of automation, without asking the person anything.
- A JavaScript check without computation, or a built-in vector-image CAPTCHA (distorted characters or a small sum) whose answer never leaves the server.
- Cloudflare Turnstile, hCaptcha or reCAPTCHA as an explicit option: the visitor's address then goes to the provider and its script is loaded in the browser.
- Without a valid key, the site falls back to proof of work. If the provider is unreachable, the visitor stays on the challenge, or gets through according to your setting.
Ainda não testada em condições reaisThe real Turnstile, hCaptcha and reCAPTCHA services have never been tried. Open your site in a private window to check the challenge before relying on it.
Verified crawlers
Gratuito
A crawler that claims to be Googlebot is confirmed by forward-confirmed reverse DNS, or by published address ranges.
- The built-in list covers Googlebot, Bingbot, Applebot, DuckDuckBot, YandexBot, Baiduspider, Slurp and the crawlers of Facebook, X and LinkedIn.
- A crawler that claims to be one and fails verification is blocked as a spoof.
AI crawlers
Gratuito
A policy per site: allow, log (default), challenge or block, with a list of exceptions.
- The built-in list covers GPTBot, ClaudeBot, PerplexityBot, CCBot, Bytespider, Amazonbot and others.
- You can allow a partner and block the rest, crawler by crawler.
Under attack mode
Gratuito
A switch that makes every visitor pass a challenge before reaching your sites, for as long as the attack lasts.
- The « Under attack » button in the top bar applies to every site at once, after confirmation. It is reserved to platform administrators and turns itself off after two hours.
- Through the API, the mode can also target a few sites only, with a duration of your choice.
- All visitors are challenged (proof of work), except those who already hold a valid clearance cookie, verified search engines, the addresses of your allow list and exempt programmatic clients.
- Flood detection can also turn it on by itself (off by default), with a cool-down of 300 seconds by default.
Programmatic clients are not challenged
Gratuito
A program cannot pass a browser challenge. Before, a git clone, a download or a panel's Git deployment got a 403 error on the « Checking your browser » page. These clients are now exempt by default from the challenge imposed on every visitor: in « always challenge » mode as in Under attack mode.
- A request is exempt if its path matches (by default Git paths such as git-upload-pack, GitLab raw files and /api/), if its user agent starts with git, curl, wget, Go-http-client, python-requests (or contains PowerShell), or if it carries an Authorization or PRIVATE-TOKEN header.
- The three lists are set per site, and a single setting (ANTIBOT_EXEMPT_API) turns the exemption off to challenge programs like browsers.
- The exemption only skips the challenge: attack rules, rate limits, address reputation and access lists apply to these requests like any other.
- It is not authentication: a user agent and a header are typed by hand. If your site relies on the challenge for a path under /api/, narrow the path list or turn the exemption off for that site.
- Nodes must run the version that contains this exemption; an older node still challenges paths and headers.
Logins, sign-ups and fingerprints
Gratuito
More targeted protections against abuse.
- Limits on login paths (10 attempts in 300 seconds by default), on one-time codes (5 per hour by default) and credential-stuffing detection.
- Sign-ups refused with a disposable e-mail address (off by default).
- JA3 and JA4 TLS fingerprints when ToutWAF terminates TLS: refusal of known tools, rate limit per fingerprint, coherence check with the user agent.
- Detection of headless browsers during the challenge.
What is not done, or not proven
We prefer to say it plainly.
- The external CAPTCHA services are implemented but have never been tried with the real providers.
- Not done: behavioural biometrics, detection of account takeover and card testing, detection of content scraping or stock hoarding, and leaked-password checks.
- ToutWAF handles layer-7 floods up to what a node can process; it is not a volumetric (layer 3 and 4) scrubbing service. Keep your provider's protection in front of it.
- Limit counters live in the memory of each node: with several nodes, the effective limit per client is roughly multiplied by their number, unless the balancer pins a client to a node.
Use cases
A shop targeted by credential stuffing
A limit on the login page, detection of many accounts tried from one client, a challenge for high scores.
An attack in progress
One click on « Under attack »: every visitor passes a challenge, your Git deployments and API calls carry on.
Decide about AI crawlers
You allow a partner, log the others for a month, then decide whether to challenge or block them.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
Ainda não testada em condições reais Funciona nos testes do produto, mas ainda não foi testada com o serviço, o sistema ou o equipamento reais. A consola mostra a mesma nota onde configura a função.
Bots, abusos e tráfego de IA
- Pontuação de bot explicável de 0 a 100, utilizável nas regras e visível nos eventosGratuito
- Ações graduais: registar, desafiar, abrandar, isco, bloquearGratuito
- Prova de trabalho invisível, verificação JavaScript ou CAPTCHA integrado que respeita a privacidadeGratuito
- Cloudflare Turnstile, hCaptcha ou reCAPTCHA como opção explícita (o endereço do visitante vai então para o fornecedor) Ainda não testada em condições reaisGratuito
- Rastreadores verificados por DNS inverso: um falso Googlebot é bloqueadoGratuito
- Política para rastreadores de IA (GPTBot, ClaudeBot e outros): permitir, registar, desafiar ou bloquearGratuito
- Impressões digitais TLS JA3 e JA4, utilizáveis para recusar ferramentas e limitar o débitoGratuito
- Coerência dos cabeçalhos: user-agent, impressão digital TLS, ordem dos cabeçalhosGratuito
- Sinais de navegador sem interface (headless), verificados durante o desafioGratuito
- Limites em inícios de sessão, códigos de utilização única e preenchimento de credenciaisGratuito
- Registos com endereços de e-mail descartáveis recusadosGratuito
Anti-DDoS de camada 7 e limitação de débito
- Interruptor global «sob ataque» com um clique, na barra superiorGratuito
- Deteção adaptativa de inundações e modo sob ataque automáticoGratuito
Voltar ao valor predefinido de uma opção avançada é sempre possível. O que acontece no fim de uma licença paga está descrito nas perguntas frequentes de preços: 48 horas de tolerância, 48 horas só de leitura e depois a proteção WAF é desativada até à renovação.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.