Talk to sales

Your website’s new bouncer.

Web App & API Protection puts SentiGate in front of your domains. We absorb floods at the edge, check suspicious bots and block exploit attempts, while real visitors get in without noticing any of it.

L3L4L5L7WAFBotsAPIRate limits
Talk to sales See plans
Requests to shop.example.comExample traffic
    Click any request to see why it got that verdict
    What’s inside

    Six layers of filtering in one service.

    Each part works on its own, but they also share information. A client that fails a bot check is treated as more suspicious by the rate limiter, and a flood that the edge stops never gets as far as the WAF.

    Web application firewall

    Managed rules cover the common attacks, and custom rules let you handle the cases that are specific to your app.

    • Managed rules covering common OWASP Top 10 attacks: SQL injection, XSS, path traversal, remote code execution, SSRF
    • Virtual patches for new CVEs that protect you until your team ships the real fix
    • Custom rules on IP, ASN, country, path, method, headers, cookies, query and body
    • Log-only mode to try a rule on real traffic before it blocks anything

    Network floods, L3 to L5

    Volumetric and protocol attacks get absorbed by the whole network before they turn into a problem for one server.

    • SYN, ACK, RST, UDP and ICMP floods spread across 11 gates and dropped there
    • Reflection and amplification from DNS, NTP, memcached, SSDP and CLDAP
    • TLS handshake floods and connection exhaustion handled at the edge
    • Always on, so nobody has to turn it on in the middle of an attack

    HTTP flood protection

    These attacks often look like real visitors, so we tell them apart by how they behave.

    • Traffic baselines per host and path, so a spike on /search reads differently from a spike on /
    • Fingerprints of attack requests built while the attack is still running
    • Browser checks for suspicious clients instead of blocking whole countries
    • Catches slow attacks like Slowloris, plus cache busting and HTTP/2 Rapid Reset

    Bot management

    Some bots are useful, like search crawlers, but most of the ones hammering your login page are not.

    • Sorts traffic into people, good bots and bad bots
    • Verified search crawlers and your monitoring tools stay allowed
    • Stops credential stuffing, scraping, card testing and inventory hoarding
    • Looks at TLS fingerprints, headless browser traits, behavior and IP reputation

    API protection

    APIs can’t solve a browser check, so they get their own rules.

    • Upload your OpenAPI spec and requests that don’t match it get rejected
    • Separate policies per endpoint and per method
    • Limits per API key or token as well as per IP
    • Built for mobile apps and partner integrations as much as for browsers

    Rate limiting

    You decide how many requests are too many for each part of your app.

    • Count by IP, path, header, cookie, API key or any mix of them
    • Block, challenge or just log when a limit is hit
    • Short windows for bursts and long windows for slow, patient abuse
    • Different limits for signed-in users and anonymous traffic
    Onboarding

    Getting started takes one DNS change.

    You keep your hosting, your code and your deploy process, and SentiGate sits in front of all of it.

    1. Tell us about your domain

      Which hostnames to protect and where your origin servers live.

    2. Set up TLS

      Upload your certificate, or we issue one for your domain at the edge.

    3. Point DNS at SentiGate

      Change the record and traffic starts flowing through the nearest gate.

    4. Close direct access to the origin

      Set your origin to accept traffic only from SentiGate. If attackers already know its IP, move it to a new one so nobody can go around the gate.

    zone: example.comExample
    The small stuff

    A few more details.

    • Your origin stays hidden. Attackers see SentiGate’s addresses instead of your server’s.
    • Real client IPs come with every request in a header, so your logs and analytics stay accurate.
    • Allow and deny lists by IP, network, ASN or country, for cases where you already know who should or shouldn’t get in.
    • Every block comes with a reason: the rule, the signal and the gate that handled it.
    • Alerts when an attack starts and ends, so you hear about it from us first.
    • Log-only mode lets you test a rule on real traffic before it starts blocking.
    Rule editorCustom rule · Example
    # Stop password spraying on the login form when http.method == "POST" and http.path == "/login" and bot.score < 30 and ip.asn in $hosting_providers then challenge mode log-only for 24h, then enforce
    FAQ

    Questions we hear a lot.

    If your question isn’t here, ask us directly.

    Will SentiGate slow my site down?

    For most visitors, no. Requests land at the nearest of our 11 gates, which is often closer to them than your server is, and inspection adds very little time to each request.

    Do I have to move my hosting?

    No. Keep your cloud, your data center or your shared host. SentiGate works in front of whatever you already run, and you only change DNS.

    What happens with my TLS certificate?

    You can upload your own certificate or have us issue one for your domain. The connection between SentiGate and your origin can be encrypted as well.

    Will good bots like search engines still get in?

    Yes. Verified search engine crawlers are allowed by default, and you can add your own monitoring tools and partners to an allow list.

    Does it work for mobile apps and APIs?

    It does. API traffic gets its own policies: schema validation, limits per key or token, and no browser checks that an app couldn’t pass.

    What about services that aren’t HTTP?

    Game servers, VPN gateways, mail and other TCP or UDP services are a job for Network Protection, which covers whole IP prefixes over BGP.

    Let’s talk about your domains.

    Send us the list of domains you want to protect, and we’ll come back with a plan and a quote.

    Talk to sales See plans
    Under attack

    Let’s get you behind the gate.

    This is what happens next.

    1. Write to our NOC. Put “URGENT” in the subject and tell us what’s being hit: a domain, an IP or a whole prefix, and roughly when it started.
    2. An engineer replies with a plan. For a website this is a DNS change and usually a new origin IP that the attackers don’t know yet. For a network it’s a Letter of Authorization, route objects and a GRE tunnel, so we can announce your prefix from our edge.
    3. The flood hits our gates instead of you. Once traffic flows through SentiGate, we tune the filters with you while the attack is still going.
    noc@sentigate.cloud
    Write to the NOC

    Quick tip: if you run your own DNS, check the TTL on the record you’ll be changing. The shorter it is, the faster the switch to SentiGate takes effect.