A web application firewall in front of your site
Point your domain at Webforta and Shield filters every request at the edge - blocking, rate-limiting and challenging bad traffic - then forwards clean requests to your server. It starts in monitor mode, so nothing is blocked until you decide.
You stay in control of what gets blocked
Add one DNS record to route your domain through Webforta. Shield inspects each request against your rules at the edge and passes clean traffic to your origin. Begin in monitor mode to see exactly what would be blocked, then switch to enforce when you are confident.
Start free trialIP & country rules
Allow or block individual IPs and CIDR ranges (IPv4 and IPv6) or whole countries, with an always-allow list that bypasses every other rule.
Rate limiting
Throttle abusive clients by requests per time window, per IP or per IP-and-path, and choose whether to block or challenge offenders.
Path rules & bad bots
Block, challenge or allow specific paths (for example /wp-login.php), and challenge known abusive crawlers automatically.
Edge hardening
Force HTTPS, add HSTS and security headers your origin is missing, and set clickjacking protection - without touching your server.
Protected pages & caching
Password-protect sensitive paths with HTTP Basic auth at the edge, and cache static assets to cut load on your origin.
Event log
See blocked and challenged requests with the rule, method, path and country - so you can tune rules before enforcing them.
Honest about the traffic path
Shield is a reverse proxy: it only enters your traffic path once you point your domain's DNS at Webforta, and it filters requests at the edge before forwarding them to your origin server. Until you change DNS, nothing is intercepted.
Shield runs on Webforta's edge, built on Cloudflare for SaaS. Some capabilities depend on your plan and on your origin being reachable directly. Cloudflare is a trademark of Cloudflare, Inc.; Webforta is independent and not endorsed by Cloudflare.
See what your website shows attackers
Start a 14-day trial, verify a domain and run your first scan in about ten minutes. No card required.