Application protection
Stop HTTP floods without stopping your users.
Orbitel Shield reads HTTP in-line at the edge. Each source is held to the rate you set, slow and malformed requests are cut off, and during a flood only sources that have proven themselves get through.
- Per-source and total rate limits
- Slowloris and slow read guards
- Penalty box for repeat offenders
Rules you can read.
Every site gets its own HTTP rules: which methods and paths it accepts, how fast each source may ask, and how big or slow a request may be.
Rates per source and for everyone
Each source is held to its own request rate. If everyone together goes over the total budget, only sources that have proven themselves get through.
Paths, methods and sizes
Allow or drop by path or prefix, accept only the methods your app uses, and cap how big a request body may be.
Handshakes count too
On HTTPS, every TLS handshake counts against the same rates, so a handshake flood is held back before your servers do any crypto work.
Requests
- Ports
- 80 and 443
- Methods
- GET, HEAD and POST
- Per source
- 20 requests a second
- Everyone together
- 5,000 a second, then verified sources only
- Largest body
- 10 MB
- TLS handshakes
- Count as requests
Paths
- /wp-admin/
- Drop
- /xmlrpc.php
- Drop
- Everything else
- Allow
Slow requests
- Headers and bodies
- 20 s each, plus 1 s for every 500 bytes
- Stalled reads
- Cut off after 30 s
- Unfinished at once
- 32 per source
Built for the attacks that target apps.
Layer 7 attacks are made to look like real traffic. These guards look at how requests behave, not only at how many there are.
HTTP floods
Every source is held to its own request rate, and a total budget protects your origin. Once it is spent, verified sources keep getting through while the rest are held back.
TLS handshake floods
Each TLS ClientHello counts as a request, so floods of handshakes are held to the same rates before your servers spend any time on them.
Slowloris and slow POST
Headers and bodies have to keep arriving. Limits start from what Apache’s mod_reqtimeout allows, so real clients on slow links still finish.
Slow reads
Clients that stop reading to tie up connections are cut off after a grace period, and no source may leave more than a few requests unfinished.
Malformed and evasive requests
Overlong lines, piles of headers and deep pipelining are refused, and request lines split on purpose to slip past filters are dropped.
Game handshakes
Beyond HTTP, game filters admit only players that finish the game’s own handshake, such as RakNet for Minecraft Bedrock, and keep them admitted while they play.
Bots have to earn their way in.
Rate limits stop the loudest sources. Reputation and machine learning deal with the ones trying to blend in.
Proof, not guesswork
A source earns trust by answering a challenge, completing a handshake or getting answers from your servers. Trusted sources pass straight through for a while.
A penalty box for repeat offenders
Sources that keep breaking the rules sit out for a minute, then ten, then an hour. Stay clean and the next sentence steps back down.
Models that notice probing
Classifiers score what the rules let through. When someone starts testing where your limits are, they tighten for a while.
At a glance.
- Where it runs
- In-line at the edge, on the ports you choose
- Methods
- GET, HEAD and POST by default, or the list you set
- Rate limits
- Per source, plus a total budget for everyone together
- HTTPS
- Every TLS handshake counts against your rates, with no certificates to hand over
- Slow requests
- Headers and bodies get 20 seconds each, plus a second for every 500 bytes
- Request limits
- 8 KB lines, 100 headers and 64 pipelined requests by default
- Penalty box
- A minute, then 10, then an hour, stepping back down once a source stays clean
- Modes
- Enforce, observe or off, for every guard
Questions, answered.
Can’t find what you need? Talk to an engineer.
Do you need my TLS certificates?
No. These rules run in-line without terminating TLS. Plain HTTP is read in full, and on HTTPS every handshake counts against your rate limits, so handshake floods are held back without decrypting anything.
Will real users get blocked during a flood?
Per-source limits catch the noisiest sources first. If everyone together goes over the total budget, sources that have already proven themselves keep getting through, so your regular visitors stay online.
Can I try a rule before it drops anything?
Yes. Every guard can run in observe mode, counting what it would drop without dropping it. Switch it to enforce once the numbers look right.
Does it work for APIs?
Yes. Limit the methods, cap body sizes and require a User-Agent that starts with your app’s own prefix, so scripts that don’t identify themselves never reach your API.
Who sets up the rules?
Our engineers set them up with you during onboarding and tune them to your traffic. Ask for a change any time from a ticket in the panel.