Why
HexShield came out of a single question: how do I protect a site without handing its traffic to a huge shared network whose rules and pricing I do not control?
Large cloud WAF networks work well. But their plans and rule limits are designed for millions of customers, and on usage-priced plans an attack can make your bill grow too. For some businesses that is an acceptable trade. For others it is not.
This product was written for the second group: a hosted protection layer running on HexShield's own edge servers, every switch available on the one paid plan, nothing to install on your side, and a bill that stays the same while you are under attack.
What we believe
A false positive is worse than a missed attack
This is design rule number one. It is easy for a security product to boast about how many requests it blocked; it is hard to say how many real customers were in that number. Here rate limits ask for verification instead of banning, shared egress addresses are considered explicitly, and every release runs tests that assert real users were not blocked.
The protection layer must not take down the site it protects
Rule number two. CPU and RAM are spendable; availability is not. If the body inspection engine is unreachable, the request passes. Under global pressure the edge drops into a cheap mode. A defence must not turn into an amplifier for the attack.
The code does what the panel says
When a switch's description and its behaviour drift apart, the user is quietly misled. So we run an automatic checker that validates panel text against the code: if the text says "returns 429" and the code bans the IP, the test goes red.
No invented numbers
Every value you see in the panel is a measured one. Nice-looking but untrue figures like "3.2 Tbps capacity" or "42 active nodes" were deliberately removed from this product. A number is either real or it is not there.
What we do not promise
Being honest means stating the limits too. Your domain is served by a HexShield edge server, not by a global anycast network. A volumetric attack of hundreds of Gbit/s can exceed that server's link capacity and no software changes this. We filter what fits down the edge's link; attacks beyond it are listed as an exclusion on the Service Level page.
We have no global anycast network. We have no hundreds of PoPs. Saying we do not is more useful than claiming we do.
Put your site behind the shield today
Nothing to install. Point your DNS at the HexShield edge, keep your origin IP out of sight, and filter attacks before they reach your server.