One console for your servers
Add a Linux or Windows server with a generated script or over SSH, and follow it with the others.
Cluster and nodes
Add your existing servers and watch them from the same console, with a small agent that only opens outbound connections. Install other ToutWAF protection nodes over SSH and see, for each one, its version and whether it has caught up with the policy and the certificates.
Where to find it in the console : Infrastructure menu: Cluster, Server monitoring, Fleet and licence.
What it is for
No port to open on your servers
The agent calls the console over HTTPS. The console never connects to the servers, even to send them a command.
See, grade, fix
Live dashboard, security grade from A to F, and guided fixes with preview, undo and lock-out guards.
Several protection nodes
Install a ToutWAF node over SSH, give it a country and follow its version and any lag behind the policy.
How a server joins the console
A single-use enrolment token, an agent, and a channel that only leaves the server.
Add the server
A generated script to run on the server, or an installation over SSH from the console: the host key fingerprint is confirmed first, the credentials are used once and never kept.
The agent calls the console
Outbound connections only, on port 9444 by default. Commands wait in a queue and the agent picks them up; a command not collected within 10 minutes expires.
You follow and act
The server is online if it has spoken in the last 45 seconds. Each action is reserved to a specific permission and recorded in the audit log.
Audit, fixes and terminal
免费
What the agent does on a server, with guardrails.
- An audit of access, network, updates, system, web server and malware gives a grade from A to F.
- 19 guided fixes, validated in advance: preview, apply, undo when possible, and lock-out protection. Anything outside the catalogue is refused.
- Intrusion alerts on 13 kinds of change (new ports, accounts and SSH keys, brute force, modified files, web shells), and antivirus scans with ClamAV on Linux and Microsoft Defender on Windows, with quarantine.
- Remote terminal in the browser, reserved to its owner, audited, with no SSH port to open.
- The agent runs as root (or LocalSystem on Windows), because the audit, the fixes and the terminal need it. « Monitoring only » mode keeps it from running any fix, scan, restore or terminal.
ToutWAF protection nodes
免费Pro 及以上
A node is a machine that runs the data plane and filters your traffic. The control plane does not connect to it: the node comes and fetches its policy and certificates.
- Installation over SSH on Linux with systemd: the official installer runs, the node enrols with a single-use token passed on standard input, and receives its policy without anything typed on it.
- Each node carries a country (with its flag), a free label and its public address; the country can be deduced from the address seen at connection. Client organisations do not see where the nodes are.
- Synchronisation state: in sync, syncing, late, in conflict (a node applies a policy newer than the console's, nothing is silently overwritten), offline.
- 免费版包含一个节点。再增加一个节点需要许可证。
Server monitoring
免费Pro 及以上
The health of the servers behind your sites, with a history kept at your premises.
- Free for one server: processor, memory, disk, load, network, services, ports and processes, with default alert rules according to the type of server.
- A 30-day detailed history and 365 days of hourly averages, adjustable. Three HTTP, TCP or TLS-certificate availability probes are free.
- Licence required: more than one supervised server, more than three probes, your own rules and thresholds, host-security inventory (packages, accounts, SSH keys, scheduled tasks) and file integrity.
What is not done, or not proven
We prefer to say it plainly.
- A ToutWAF node is installed from the console on Linux only. The data plane compiles for Windows and has an installer, but has never run on a real Windows machine.
- Installing a node was tried against a fake SSH server, not on real machines; no test updates a node while it carries traffic.
- On the agent side, a real Windows Server 2025 and Linux with a real ClamAV were exercised. Not yet: the full life cycle of a Windows service, the Defender signature update and installing ClamAV on real machines.
- No automatic balancing between nodes, nor choice of the nearest node. A single active control plane: the standby console follows it and is promoted by hand.
Use cases
Watch three servers of an agency
One agent per server, a grade from A to F for each, and the most useful fixes applied with a preview.
Add a second protection node
Installation over SSH, country flag, then a check that it has caught up with the policy before putting it in DNS.
Troubleshoot a server without opening SSH
The remote terminal opens in the console, for its owner, and every session is audited.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
版本免费 包含在所有方案中，包括两个免费方案（Free 和 Free +）Pro 及以上 付费方案：在控制台中可见，无许可证时被锁定。从 Pro 起，另有标注 Agency 或 Enterprise 的除外
尚未在真实环境中试过 在产品测试中运行正常，但尚未用真实的服务、系统或设备试过。您设置该功能时，控制台会在相应位置显示同样的提示。
服务器与主机代理
- 用生成的安装脚本或通过 SSH 安装来添加服务器免费
- 适用于 Linux 和 Windows 的小型代理，只发起出站连接免费
- 每台服务器的实时仪表盘：CPU、内存、磁盘、网络、端口、进程免费
- A 到 F 的安全评分，审计访问、网络、更新、系统、Web 服务器和恶意软件免费
- 19 项引导式一键修复，支持预览、撤销和防锁死保护免费
- 针对 13 类变化的入侵告警：新增端口、账户和 SSH 密钥、暴力破解、被修改的文件、Web Shell免费
- 杀毒扫描：Linux 使用 ClamAV，Windows 使用 Microsoft Defender，并支持隔离免费
- 浏览器中的远程终端：仅限会话所有者使用，留有审计记录，无需开放 SSH 端口免费
- SSH 安装绑定您先行确认的主机密钥指纹；凭据只用一次，绝不保存免费
- 一个 ToutWAF 防护节点，通过 SSH 或生成的命令安装，显示国旗、版本和同步状态免费
- 多个防护节点，由控制台安装并保持同步Pro 及以上
- 在全新服务器上远程安装 ToutPanel（网站托管面板），随后安装其 Web 栈（默认 Nginx、MariaDB、PHP 8.5） 尚未在真实环境中试过免费
- ToutPanel Web 服务器：通过命令或 SSH 关联，使用专用令牌、固定证书和心跳；待 ToutPanel 交付其部分后，ToutWAF 即成为面板的 WAF 引擎 尚未在真实环境中试过免费
服务器监控
- 第一台受监控的服务器免费：处理器、内存、交换区、磁盘、inode、负载、网络、服务、端口和进程免费
- 本地证书到期、待安装的安全更新、最近一次备份的时间、代理失联时长免费
- 按服务器类型（Web、数据库、邮件、DNS、容器）预设 25 条告警规则，含“注意”和“严重”两级阈值免费
- 按服务器、指标和对象发出告警，支持确认，恢复正常时发出通知免费
- 为您选定的指标自定义规则和阈值Pro 及以上
- 监控多台服务器Pro 及以上
- 历史数据保存在您自己的安装中：30 天明细、365 天小时均值，均可调整免费
- 从您的安装发起的可用性探测：HTTP、TCP 和 TLS 证书检查（3 个免费）免费
- 超过 3 个可用性探测Pro 及以上
- 当承载源站的服务器资源耗尽时通知 WAF免费
- “仅监控”模式：代理不会在该服务器上执行修复、扫描、恢复或终端操作免费
- 主机安全：盘点软件包、账户、SSH 密钥和计划任务，漏洞比对在您的控制台上完成（软件包清单绝不外传）Pro 及以上
- 监测您指定文件的完整性，并提供 25 项只读的加固检查Pro 及以上
随时都可以把高级选项恢复为默认值。付费许可证结束后会发生什么，见定价页的常见问题：48 小时宽限期、48 小时只读，之后 WAF 防护关闭，直到续订。