TurtleGuardl7 / waf
Website DDoS protection
Requests to your site reach TurtleGuard nodes first. Floods, bots and break-in attempts stay there, only real visitors get through to your server. The site stays with your current host.
What we stop
Link and connection floods
L3 and L4 attacks are absorbed on our nodes before they reach your server. Its link and TCP stack never see them.
HTTP floods and bots
Thousands of requests a second to heavy pages, search and the cart. The node counts requests per address, checks the browser and cuts whatever behaves like a script.
Break-ins and scanners
SQL injection, XSS, password guessing, hunting for .env files and admin panels. The OWASP CRS WAF blocks these requests at the door.
What runs on your site
Browser check and captcha
Doubtful requests get a short in-browser check, and a slider captcha when you need it stricter. A person passes once, bots stop. Google and Yandex crawlers are recognised and let through without a check.
WAF and your own rules
Ready OWASP CRS rules plus your own: by path, method, country, AS, headers and User-Agent. Actions: block, check, captcha, skip or log.
Your server address stays hidden
Only TurtleGuard addresses are visible. Close 80 and 443 on your server to everyone but our subnets, and nobody can attack the IP directly.
Certificates and cache
We issue and renew Let's Encrypt certificates ourselves. On Premium, static files come from node cache and your server gets fewer requests.
How to connect
Add the domain
In the dashboard enter the domain and your server address. No file moves, no hosting change.
Change DNS
Set our nameservers or point the A records at our addresses. A subdomain needs a single CNAME.
Traffic goes through protection
Usually in 10–30 minutes, once the records update. We issue the certificate and visitors notice nothing.
Pricing
Basic $10 a month: WAF and browser check. Standart $30: every protection mode, proxied DNS records, up to 10 custom rules. Premium $80: plus CDN. Enterprise $200: up to 5 sites. You are charged once the site works through protection, and the first week of the first site is free.
Website protection questions
How long does connecting take?
The dashboard part takes a couple of minutes. Then DNS records need to update: usually 10–30 minutes, rarely a few hours.
Do I have to move my site to you?
No. The site stays with your host, we only take the traffic and forward clean requests to your server.
What if an attack is bigger than the plan's bandwidth?
We bring in more capacity ourselves and tell you in the dashboard. There is no extra charge for attack size.
Will I lose search rankings?
No. Google, Yandex and Bing crawlers are verified by their networks and pass without a browser check, and the site keeps working over HTTPS at the same address.
The attacker knows my server's IP. Will protection help?
Yes, once the server is closed to direct requests: keep 80 and 443 open only for TurtleGuard subnets. Ready rules for nftables and cloud firewalls are in the docs.
Didn't find the answer? Write to us, support answers around the clock: @turtleguard_cloud