Web Application Front

Low-latency Web Application Front cloud protection service which will protect, accelerate and stop attacks. It can protect any hosted website in the world.

This web application front security platform will is your front door. It will improve, secure and boost website performance to many private, hybrid or multi-cloud environments.

All-in-one website protection

The Web Application Front will protect, accelerate and stop attacks to your websites. It’s your secure front door, which keeps your web applications safe.

It is specially designed for companies that need to manage their volume websites in detail. Advanced automation and management tooling will add value to any existing business model. As a result, it will boost anyone’s online success!

If you have any questions, please email to waf@serverius.net

Low latency Web Application protection

“We can protect any website in the world”

“Our front door protection shield is protecting websites around the world. No matter if it’s hosted in or outside the Netherlands. 99% of our users are using external data centers and public cloud providers like AWS, Azure, and Google.”

Patrick Cress, Developer R&D department

100% API first

Every technical function has been developed by an “API first” principle, which means that all available functionality is offered by https://api.serverius.net. The API has even more functionality than our own Serverius client panel: https://my.serverius.net. By using an API you can easily integrate everything into your infrastructure and order processes. And at the same time you can keep working on the web interface.

Web application Firewall API

Unique technology, it’s ultra-fast

All software technology is 100% created by Serverius. We do not use any third-party or open-source software of others. This software is hosted at Serverius its own clustered hardware and IP networks. That’s how we guarantee low latency and high throughput to our users.

low latency and high throughput waf

Custom made settings per website

Administrators can provide each website with its own configuration. But by using an API call it’s also possible to maintain one configuration for multiple websites. For example, if you have 1000 websites under management, you can adjust them simultaneously with just a single request.

web application security platform

Let’s Encrypt by default

When adding a domain to the Web Application Front, a Let’s Encrypt SSL certificate will created by default. It will save you install and update SSL certificates at your hosting environment. And of course, this free SSL can also be overruled by uploading your personal/commercial SSL certificate.

Layer 3, 4, and 7 website DDoS protection

The Web Application Front offers volume Layer 3/4 volume and advanced application-Layer 7 DDoS protection. Its protection mechanism is using lots of techniques to identify real request HTTP requests from fake ones. Secure techniques such as custom made captcha pages, error page offloading, protocol checks, session integrity checks, source IP rate-limits, active and passive client challenges, historical client reputation blacklists and anomalous idle-time detection.

Application DDoS protecton by WAF

The GEO-IP country blocking

Per country or continent you can allow, re-captcha or block its users. When blocking, you can use customized error pages to show your users a tailor-made message with your own logo, text, designed with your own CSS.

geo ip waf ddos firewall feature

Application IP load balancing

The Web application Front web proxy will forward clean traffic to one or multiple internet IP addresses. This way users can use it to protect any internet address in the world. When using multiple, your data traffic will be balanced by the weight you will set. This allows users to distribute load to multiple hosting resources to maximize their throughput, create redundancy, and avoid overload of any single resource.

You can use many load balancing types like Round Robin, Weighted Round Robin, Least Connection and Weighted Least Connection. And of course, the addition of IP subnets can be set by web interface or API.

proxy ip subnet load balancing destination ip subnet

OWASP Core Rule Set support

The OWASP ModSecurity Top 10 Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls. The Serverius WAF supports many common attack categories like including SQL Injection (SQLi), Cross Site Scripting (XSS), Local File Inclusion (LFI), Remote File Inclusion (RFI), Remote Code Execution (RCE), PHP Code Injection.

Automatic internet standards improvements

The WAF will set all kinds of internet standards on your website. Most of them are application security options that activate browser mechanisms to protect visitors against attacks with e.g. cross-site scripting (XSS), framing, removing old TLS versions, wrong HTTPS redirects, wrong cipher orders, etc, etc.

As a Dutch company, we use internet.nl as a starting point, but of course there are many other tools to check your website security and SSL settings.

Automatic internet standards improvements

Content Security Policy builder

Content Security Policy (CSP) headers allow you to define where your web pages are allowed to load website content. The WAF contains an easy to use Content Security Policy generator which will add a CSP to the WAF. It works by API or web interface, simply by selecting the things you want to allow.

It will make your life easy and it will safe many hours of work.

Content Security Policy CSP builder

Connect, protect and forward clean traffic locally

The Serverius WAF service is physically available in many countries around the world. All data centers PoPs are working together to protect your application. By using anycast IP routing all web traffic will be cleaned and forwarded locally to its users. The data traffic from the host to its user will not leave its continent. Therefore data will automatically apply to its local country laws.

Every edge location of our global anycast network is included, with no additional charges for using the whole map or any specific region. Our global threat intelligence system will identify global security vulnerabilities and add them to the global WAF policies which will be pushed to all scrubbing centers worldwide.

Wholesale packages

You can purchase a bundle of web requests which you can use for just one or many web applications. This way, your resources are shared between multiple clients and/or websites.

  • Free setup:Free setup:
  • Month per month pre-paid contract term:Month per month pre-paid contract term:
  • Minimum discount for paid DDoS IP protection users:Minimum discount for paid DDoS IP protection users:
  • Amount of web applications (websites) configurationsAmount of web applications (websites) configurations
  • Amount of (sub)domain names:Amount of (sub)domain names:
  • Total amount of data traffic and HTTPS web requests for all websites:Total amount of data traffic and HTTPS web requests for all websites:
  • Unlimited amount of attack included:Unlimited amount of attack included:
  • OWASP top 10 WAF functionality included:OWASP top 10 WAF functionality included:
  • 100% layer 3 and 4 volume DDoS protection guarantee:100% layer 3 and 4 volume DDoS protection guarantee:
  • Advanced layer 7 DDoS protection with realtime HTTPS data traffic inspection:Advanced layer 7 DDoS protection with realtime HTTPS data traffic inspection:
  • Application (forward IP) load balancing:Application (forward IP) load balancing:
  • Support type:Support type:
  • Amount of custom WAF rules:Amount of custom WAF rules:
  • 100% Rest-API functionality (https://api.serverius.net):100% Rest-API functionality (https://api.serverius.net):
  • Free BGP announcement of your own private IP subnets:Free BGP announcement of your own private IP subnets:
  • Customized ReCaptcha form and custom error pages:Customized ReCaptcha form and custom error pages:
  • Audit logs:Audit logs:
  • IP black and white-listsIP black and white-lists
  • Internet standards improvementsInternet standards improvements
  • Content Security Policy (CSP) builderContent Security Policy (CSP) builder
  • App-Front 100

  • 349,-
    monthly
  • Free setup:
  • Month per month pre-paid contract term:
  • Minimum discount for paid DDoS IP protection users:10%
  • Amount of web applications (websites) configurations10
  • Amount of (sub)domain names:100
  • Total amount of data traffic and HTTPS web requests for all websites:Fair use
  • Unlimited amount of attack included:
  • OWASP top 10 WAF functionality included:
  • 100% layer 3 and 4 volume DDoS protection guarantee:
  • Advanced layer 7 DDoS protection with realtime HTTPS data traffic inspection:
  • Application (forward IP) load balancing:
  • Support type:Office hours ticket & mail support
  • Amount of custom WAF rules:None
  • 100% Rest-API functionality (https://api.serverius.net):
  • Free BGP announcement of your own private IP subnets:
  • Customized ReCaptcha form and custom error pages:
  • Audit logs:
  • IP black and white-lists
  • Internet standards improvements
  • Content Security Policy (CSP) builder
  • App-Front 500

  • 749,-
    monthly
  • Free setup:
  • Month per month pre-paid contract term:
  • Minimum discount for paid DDoS IP protection users:15%
  • Amount of web applications (websites) configurations50
  • Amount of (sub)domain names:500
  • Total amount of data traffic and HTTPS web requests for all websites:Fair use
  • Unlimited amount of attack included:
  • OWASP top 10 WAF functionality included:
  • 100% layer 3 and 4 volume DDoS protection guarantee:
  • Advanced layer 7 DDoS protection with realtime HTTPS data traffic inspection:
  • Application (forward IP) load balancing:
  • Support type:Office hours ticket & mail support
  • Amount of custom WAF rules:20
  • 100% Rest-API functionality (https://api.serverius.net):
  • Free BGP announcement of your own private IP subnets:
  • Customized ReCaptcha form and custom error pages:
  • Audit logs:
  • IP black and white-lists
  • Internet standards improvements
  • Content Security Policy (CSP) builder
  • App-Front 1000

  • 2849,-
    monthly
  • Free setup:
  • Month per month pre-paid contract term:
  • Minimum discount for paid DDoS IP protection users:20%
  • Amount of web applications (websites) configurations250
  • Amount of (sub)domain names:5000
  • Total amount of data traffic and HTTPS web requests for all websites:Fair use
  • Unlimited amount of attack included:
  • OWASP top 10 WAF functionality included:
  • 100% layer 3 and 4 volume DDoS protection guarantee:
  • Advanced layer 7 DDoS protection with realtime HTTPS data traffic inspection:
  • Application (forward IP) load balancing:
  • Support type:24x7 telephone, ticket & mail support
  • Amount of custom WAF rules:50
  • 100% Rest-API functionality (https://api.serverius.net):
  • Free BGP announcement of your own private IP subnets:Upt to a /18
  • Customized ReCaptcha form and custom error pages:
  • Audit logs:
  • IP black and white-lists
  • Internet standards improvements
  • Content Security Policy (CSP) builder

Register to start

Start today. Create your free Web Application Front test account:

  1. Register a 10 day AppFront trial by this form.

  2. Point your website(s) DNS A record to the WAF IP address.

  3. Forward all cleaned data traffic to your web server IP address.

That’s it! you’re protected! If you like you can tweak setting, enable extra’s and start testing your defenses.