Secure and Optimize Your Site

The assistant analyzes your last 30 days of traffic and recommends vetted protection templates you can apply in one click — always installed in dry-run mode first. The Security Copilot answers plain-language questions about your protection, blocks, and anomalies using your real metrics, and a weekly AI digest lands in your inbox like a briefing from a security analyst. Every AI feature runs under a per-tenant cost guardrail.

Define granular access policies using criteria like IP range, User-Agent, country, request path, rate limits, and custom headers. Choose from multiple actions including raw block, JavaScript challenge, Captcha, redirection, or traffic throttling.

Suspicious visitors solve a small computational puzzle before they get through — no image grids, no tracking, no external service. Tokens are encrypted, replay-protected, and bound to the visitor, and the difficulty scales with the risk score. Use it as a rule action, let the managed threat-feed rule trigger it automatically, or embed the same widget on your own forms. Cloudflare Turnstile and hCaptcha remain available as alternatives.

Keep unwanted regional traffic away from your servers. Block or challenge entire countries or narrow down constraints to specific cities. Ideal for localized compliance and optimizing resource usage.

A curated blocklist of known-bad IP ranges syncs on a schedule and feeds directly into every visitor's risk score. Turn on the managed rule template to block or challenge listed IPs with one toggle, inspect the threat context right inside enforcement and session views, and let the retroactive sweep re-check recent sessions whenever new ranges are listed — so you know if a threat visited before it was known.

Allow trusted partners and internal APIs bypass security checks with whitelists, while instantly locking out known malicious actors using static blacklists. Supports individual IPv4/IPv6 addresses and CIDR subnets.

Analyze behavioral metrics dynamically. If a client exceeds safe request velocity, acts like a headless browser, or scrapes content aggressively, our system triggers progressive security challenges without interrupting human visitors.

Inject hidden endpoints, hidden inputs, or fake directory paths in your HTML. Genuine visitors will never see them, but scrapers and vulnerability scanners will interact with them, leading to an immediate and permanent IP ban.

Powered by Laravel Reverb WebSockets. Experience zero-delay traffic monitoring. View geographical distributions, incoming paths, block rates, and visitor browser details live without manual page refreshes.

See your web pages through your users' eyes. Identify which call-to-actions get clicked, how far users scroll down, and identify dead zones where users get frustrated. All tracked privacy-safely without collecting personal identifiers.

Never miss a security event. Define notification triggers for anomaly detections, high-rate bot attacks, honeytoken triggers, or custom rule matches. Deliver payload data securely with signed webhooks.

Manage sites, fetch security events, toggle rules, update white/blacklists, and retrieve heatmap data through our developer REST API. Authenticate requests securely using scoped API keys.

Configure daily, weekly, or monthly reports. Get PDF security performance summaries or export raw event logs in CSV format. Keep your team and stakeholders informed with clean, structured summaries automatically.

Invite developers, analysts, and administrators. Assign custom roles (Owner, Admin, Member, Read-Only) to isolate settings adjustments and billing details from daily analytics viewing.

Install our official plugin directly from the WordPress repository. Enter your site keys to immediately load the analytics script and sync local rule actions. Features built-in support for WooCommerce checkout protection.