NewOne plan from €9.90, extra domains €1, every feature included
Live attack statistics →Always-on protection for websites and APIs
Let the Traffic Flow.
Leave the Flood Behind.
Point your DNS at Akarguard. Your customers keep shopping, signing in and reading while the attack burns out on our servers instead of yours.
Domains
4 protected · auto mode on
Traffic
41.6M
requests in the last 7 days
Mitigated
9.3M
22% never reached an origin
Bots checked
312K
JavaScript and CAPTCHA checks
Origin p50
38 ms
median response time
Automatic mitigation
The Life of a Flood, Without Anyone Pressing a Button.
0 s
Baseline
The edge keeps a rolling picture of each domain's normal traffic.
~10 s
Detected
Filtered traffic jumps far above that baseline. An incident opens and you get an email.
~10 s
Raised
The browser check switches on for that domain only. Your other domains are not touched.
seconds
Banned
Sources over the limits are banned on the domain; persistent ones are dropped in the kernel.
15 min quiet
Restored
Once the domain has been calm for a while, it returns to its own mode by itself.
after midnight
Reported
One email with the day's attacks and a PDF, minute by minute.
Four filters between the internet and your server.
Cheap checks run first, careful ones last, so a flood is spent long before it costs you anything.
Received
148,930
Turned away at the handshake
112,407
Did not pass the challenge
6,215
Stopped by rules
853
Forwarded to the origin
29,455
| UTC | Verdict | What | Why | Source |
|---|---|---|---|---|
| 09:12:41 | ■ Challenged | GET /account | no JavaScript, gave up | 203.0.113.61 |
| 09:12:40 | ■ Refused | TLS hello | known attacker, 30-day memory | 198.51.100.77 |
| 09:12:38 | ■ WAF | GET /search?q=1' OR '1'='1 | SQL injection | 192.0.2.140 |
| 09:12:37 | ■ Allowed | POST /cart | 200 · 27 ms | 198.51.100.9 |
| 09:12:35 | ■ Kernel drop | GET /?p=93ka1 | 4,112 requests in 10 s | 203.0.113.230 |
| 09:12:33 | ■ Shield | GET /.git/config | secret-file probe | 192.0.2.57 |
1
Handshake
Known attackers and flood sources are turned away before TLS completes, and the worst offenders vanish into a kernel drop list.
2
Challenge
Clients that cannot prove they are a real browser get a quick JavaScript test, and a CAPTCHA only if they keep trying.
3
Rules
Your own blocks, the WAF and the threat shield catch exploit attempts, scanners and anything you have ruled out.
4
Origin
What remains is forwarded to your server over HTTPS, with static files cached and the visitor's real address attached.
Nothing to install on your server: you change an A record and keep your hosting. Setup guide
What you get
Heavy Protection.
Light Touch.
Bots get a test. Humans get the page.
Most visitors never see a thing. Suspicious clients solve a short JavaScript task; only stubborn ones meet our CAPTCHA. Google, Bing and other verified crawlers are waved through.
Akarguard
Just a second…
Making sure you are not a bot. You will be on store.example.org shortly.
Web application firewall
Learning mode first, blocking when you are ready, exceptions per path.
Threat shield
Exploit paths probed across many sites, and fresh CVEs from public feeds, are learned and then blocked on every domain.
Private pages
A password in front of /admin or /wp-login.php, checked at the edge.
TLS and speed
Certificates issued and renewed for you, HTTP/2, HSTS, caching and WebP.
API-safe mode
API hostnames get limits and filtering, never a check an app cannot solve.
Your own rules
Block or allow by any of these, plus per-path cache, redirect and challenge rules.
Analytics and reports
Traffic, countries, status codes and origin times per domain. An alert when an attack starts, a daily PDF of everything filtered, and synthetic checks of your site.
Attacker memory
Caught Once.
Kept Out.
Attackers come back. Every address we ban for attacking one of your domains stays on file for 30 days, and if it returns while that domain is under fire, the connection is closed during the TLS hello.
Works on its own for every domain on the plan.
Start Your Free TrialRemembered attackers
store.example.org under attackReturning sources refused in the last hour · example data
| Source | Network | History | Refused at |
|---|---|---|---|
| 192.0.2.214 | VN · cloud VPS | first seen 6 days ago | kernel |
| 198.51.100.130 | BR · residential | first seen 2 days ago | handshake |
| 203.0.113.47 | US · hosting | first seen 19 days ago | kernel |
| 192.0.2.89 | ID · mobile | first seen today | handshake |
| 198.51.100.202 | DE · hosting | first seen 11 days ago | kernel |
Drop lists in the kernel
The noisiest sources never reach the web server at all: their packets are discarded before a connection exists.
Handshake fingerprints
Many attack tools give themselves away in the TLS hello. They are stopped before the first request.
Learning shield
When the same exploit path is tried on many customer sites, a rule is learned and applied to everyone.
A lane for your origin
Traffic from your own servers uses a separate entrance, so a flood elsewhere does not slow it down.
Proof
Measured on Our Own Edge.
14 October 2026, 19:00–19:50 UTC. One bar per minute, straight from our traffic database.
13.9M
requests in the busiest minute
~230K
requests per second at the peak
99%
of that minute filtered at the edge
~2K
normal requests a minute, before and after
Pricing
Start at €9.90.
Grow for €1.
€9.90 a month protects your first domain, and each domain after it adds €1. Every one includes 10 subdomains at no charge. The firewall, bot checks and attack reports are not upsells; they are on from the first day. A big attack costs you exactly the same as a quiet month.
- 01
Create an account
Your card is saved at checkout, but the first 7 days cost nothing.
- 02
Prove it's yours, then switch DNS
A TXT record confirms ownership. One A record sends traffic through Akarguard.
- 03
Forget about floods
Billing (€9.90, plus €1 for each extra domain) begins on day 8. Cancel in the dashboard any time before that.
The only plan
Akarguard Standard
€9.90a month, first domain
- Ten subdomains free on every domain, on top of the apex and www.
- Add domains for €1 a month each. The free subdomains come with every one
- Scale up or down from the dashboard; added domains are prorated
- Attack traffic is free. A flood never raises your bill
- Layer 7 DDoS mitigation
- Web application firewall
- Bot management and challenge
- Hidden origin IP
- Automatic TLS certificates
- Caching and compression
- Password-protected admin pages
- Attack alerts and daily reports
- Live traffic dashboard
- Threat shield for new exploits
7 days free, then €9.90 a month plus €1 for each extra domain. Prices exclude VAT. Cancel any time from your dashboard.
Hosting provider or many domains?
Write to us for volume pricing and reseller terms.
FAQ
Before You
Point Your DNS.
The questions people ask us most. If yours is not here, mail support@akarguard.net; the engineers who run the edge read that inbox.
What does Akarguard protect?+−
Websites and APIs served over HTTP and HTTPS. Akarguard is a Layer 7 reverse proxy: HTTP floods, attack tools, bots and web exploits are filtered at the edge, and your origin IP stays hidden so it can't be attacked directly. It is not a volumetric L3/L4 scrubbing service.
Do I need to change my server or code?+−
No. You add the domain in the dashboard, prove ownership with a TXT record and point the A record at the edge address shown to you. A certificate is issued automatically. Your hosting, stack and deployment stay exactly as they are.
What happens during an attack?+−
The edge raises protection for that domain by itself, drops attack traffic and forwards clean requests, so the site stays online. Sources that keep flooding are banned in the kernel. You get an email when the attack starts and a daily PDF report of the day's attacks.
Will my visitors see a challenge page?+−
Normally not. The browser check appears only while a domain is under attack, or if you switch it on yourself, and real browsers clear it in a moment. Verified search-engine crawlers are always let through, and the challenge can be kept off for API hostnames.
Is there a web application firewall?+−
Yes, on every domain at no extra cost. It detects SQL injection, cross-site scripting, path traversal, command injection and remote file inclusion. Start in learning mode to see what it would block, add exceptions per path, then switch to blocking.
Am I charged more if I get attacked?+−
No. Attack traffic is filtered at the edge and is never billed: your bill stays the same with or without an attack.
How does the free trial work?+−
Every subscription starts with a 7-day free trial. You enter card details to start it, nothing is charged during those 7 days, and cancelling before the trial ends means you are never billed. After the trial it is €9.90 a month for your first domain and €1 a month for each extra one, with ten subdomains included on every domain.
Trust
Your Visitors' Data Stays Boring.
A protection service sits in the middle of every request, so it should keep as little as it can. Here is what we hold, for how long, and what we never touch.
No captcha vendor
Our browser test and CAPTCHA are our own code on our own servers. Your visitors are not sent to Google or anyone else.
One cookie, one job
After a visitor passes a check we set a single cookie so they are not asked again. Nothing for ads, nothing for tracking.
48-hour request samples
The dashboard keeps a sample of request metadata for two days. Bodies, cookies and passwords are never stored.
HTTPS end to end
Certificates for every protected site and the dashboard, and HTTPS to your origin whenever it supports it.
Every admin action logged
Changes our staff make to a customer domain land in an audit log with who, what and when.
Paperwork in public
Our data processing agreement and the list of subprocessors are on the website for anyone to read.