TurtleGuardmini app / bot
Telegram mini app and bot DDoS protection
The mini app, its API and the bot's webhooks run through TurtleGuard nodes. Floods and bots stay with us, Telegram and payment providers reach your server untouched.
What breaks mini apps and bots
Mini app API floods
A script hammers the endpoints the front end calls: login, balance, catalogue. The server goes down and the app stops loading for users.
Attacks on the webhook
The webhook address is easy to find from the app's requests. Flood it, and the bot stops answering while Telegram itself is fine.
A direct hit on the server
Once the server IP is known, the attack goes around any domain filter. So the address has to be hidden and direct connections closed.
How we protect it
The check works inside Telegram
A mini app opens in Telegram's built-in browser, and our check runs there too, with no separate page. Launch data in the address (tgWebAppData) is kept after the check, and the app gets it as usual.
Webhooks pass without a check
Telegram and payment provider servers cannot pass a browser check. The webhook path gets an exception rule, and it can be opened to Telegram's networks only, by IP or AS.
Limits on the API
Cap requests per address to the app's API. A normal user never hits the cap, a script gets refused on the node.
Server IP hidden
The mini app and webhook run on a domain pointed at our addresses. If the bot uses long polling, incoming ports on the server can be closed entirely.
How to connect
Add the mini app domain
A separate subdomain like app.example.com connects with one CNAME record, the main domain can stay as it is.
Set up exceptions
Add a «Skip» rule for the bot and payment webhook paths, for example /webhook and /callback, for the POST method only.
Update the address in BotFather
If the mini app address did not change, there is nothing to do. A new domain goes into BotFather and setWebhook.
Pricing
A mini app connects like any site: Basic $10 a month, Standart $30 with proxied DNS records and 10 custom rules. The first week of the first site is free, and you are charged once the site works through protection.
Mini app and bot questions
Will users see a check inside Telegram?
Only on suspicious traffic, and usually for a second. The check runs in Telegram's built-in browser and returns the user to the app with the same launch data.
Won't the webhook stop receiving updates?
No, once the webhook path has an exception rule. We suggest letting it through for POST only and only from Telegram's networks.
What about payment provider webhooks?
The same: a «Skip» rule for the callback path. Payment providers call from their own addresses and cannot pass a browser check.
My bot uses long polling. Does it need protection?
The bot itself waits for no one in that case, so its server can be closed to incoming connections. Protect the mini app, its API and payment webhooks.
Does this fit apps on Remnawave and other panels?
Yes. The mini app, the dashboard and subscription links go through the nodes like a normal site. Subscription paths have ready settings so VPN clients fetch them without a browser check.
Didn't find the answer? Write to us, support answers around the clock: @turtleguard_cloud