5
edges in 4 independent networks
Distribute
Attacks don’t hit one server but five edges in four independent networks. If an edge fails, DNS redirects visitors to the others within seconds.
DDoS protection
Attacks end with us. Not with you.
Whatever the CDN rejects never reaches your server. DDoS protection works in four layers – from spreading traffic across five edges to serving from the cache – and you can see at any time what was blocked.
- Free plan, forever
- no credit card required
- set up in minutes
- DDoS protection
- 4 layers
- in 4 independent networks
- 5 edges
- SQL injection, XSS, scanners
- WAF
- server hidden
- Origin
DDoS protection
DDoS protection in four layers. Before anything reaches you.
An attack has to get past all four layers – most end at the very first.
0
open ports with Expose Host
Hide
Nobody can attack an address they don’t know: origin protection for websites, the plugin for Minecraft, Expose Host without any open port.
200
requests/s per IP – default limit
Filter
On every edge: connection and rate limits per IP, invalid packets dropped, bot checks, WAF, country blocking – and “under attack” mode in an emergency.
24 h
served from cache during outages
Absorb
Whatever is in the cache, the CDN serves itself – even while your server is under load, for up to a day. The Minecraft server list comes entirely from the edge.
For every service
Websites, Minecraft, ports. All protected.
What the CDN stops per service
| Service | Typical attacks | Protection at the edge |
|---|---|---|
| Websites | HTTP floods, login brute force, scanners | Rate limits, bot detection, WAF, “under attack” mode, caching |
| Minecraft | Bot floods, ping floods, VPN spam | Connection limits, bot protection, server list from the cache, VPN filter |
| TCP/UDP load balancers | Connection floods against databases and services | Server hidden, at most 256 TCP connections per client address |
| Expose Host | Attacks on your home connection | Home address hidden, no open port on the router |
Origin protection
Hide first. Then protect.
The CDN only protects you if nobody can get past it to your server. Two steps, set up once.
- 1
Firewall for the CDN only
The portal lists all addresses the CDN uses to reach your server – with examples for nginx, Apache and ufw. If the list changes, you’ll be notified.
- 2
Check the CDN’s token
The CDN sends a secret in the X-KH-Origin-Auth header with every request. Your server rejects everything without it – even on web hosting via .htaccess.
- 3
Check what’s public
“What is public?” tests whether your server is directly reachable and whether old DNS records like mail or ftp reveal its address.
.htaccess (Apache)
# only requests carrying the CDN token
RewriteEngine On
RewriteCond %{HTTP:X-KH-Origin-Auth} !^YOUR-SECRET$
RewriteRule ^ - [F]
Protection features
Six layers. Right at the edge.
Every request passes these checks before it reaches the cache or your server.
IP addresses and networks
Block or always allow – your office, your monitoring or your payment provider, for example.
Countries
Block certain countries or only allow selected ones, e.g. DE, AT and CH for a regional shop.
Rate limits
A general limit per visitor IP plus your own limits for paths like /wp-login.php or /api/.
WAF
Detects SQL injection, cross-site scripting, path traversal, sensitive files like /.env, command injection (Log4Shell) and scanners. Count first, then block.
Bots and AI crawlers
Real search engines from Google, Bing and Apple are verified and let through, fake “Googlebots” are blocked. AI crawlers like GPTBot or ClaudeBot can be kept out.
“Under attack” mode
In an emergency, every visitor briefly solves a computational challenge in the browser – no clicking, no picture puzzles. Then they’re cleared for 12 hours.
Access protection
Only for your team. Or specific addresses.
For admin areas, NAS interfaces or Home Assistant: the check runs on the edges – requests without clearance never reach your server.
Sign-in via the portal
Whoever opens the site signs in to the portal. Only members of your team get through – for 1 to 168 hours per browser.
Allowed addresses
Apps, scripts and your office get through without signing in – handy for services without a browser.
Logged
Every clearance is logged. The website never sees your portal password.
Transparency
Show what was blocked. With one link.
After an attack, customers and players want to know what happened. An attack report answers that – ideal for your community on Discord.
A public page
Without a time range, the CDN finds the strongest attack itself. The page stays until you withdraw it.
The numbers
Blocked requests, peak per minute, attacking networks, reasons, countries of origin and timeline.
No IP addresses
No addresses on the page – and anonymous if you like, without domain or server address.
Does the CDN also protect Minecraft and TCP services against DDoS?
Yes. Game servers and TCP/UDP load balancers run over the same edges: your server address stays hidden, and the edges limit connections per address. For Minecraft, the server list comes from the cache and bot protection stops bot floods.
What happens if an edge is attacked?
The others take over: the edges are in five cities and four independent networks. Visitors only get the addresses of healthy edges – if one fails, DNS redirects them within seconds.
Do I have to switch the WAF to blocking right away?
No. In “count only” mode the WAF detects and counts attacks in the statistics but blocks nothing. After a few days you can see whether real visitors would be affected – then switch to “block”.
Will I stay in Google if I block countries?
Yes, with “Let real search engines through”: the CDN verifies crawlers from Google, Bing and Apple and lets them past country blocking and “under attack” mode.
What happens to apps and webhooks in “under attack” mode?
Programs without a browser can’t solve the challenge. Add their addresses under “Always allow” – then they get through.
Does the CDN set cookies?
No – except a technically necessary one in “under attack” mode that remembers the passed check for 12 hours. Access protection uses a signed cookie for that domain only.
Is the CDN enough to protect my server?
Only if nobody can reach your server directly – so set up origin protection. The WAF is an additional layer and doesn’t replace updating your software.
Get started
Protected in minutes. Start for free.
Free plan, forever · no credit card required · set up in minutes