Nexren ShieldProtect your site and APIs with five layers.
Five layers, from the kernel to the application, evaluate every request before it reaches your server.
The panel's Monitor screen · sample data, not live traffic.
What is Nexren Shield?
Nexren Shield is a reverse-proxy security platform that sits in front of websites and APIs: every request is evaluated before it reaches your server, first in the kernel with XDP, then by TLS fingerprinting, bot verification and a signature-based WAF. Origin Lock™ makes sure your server can only be reached through Nexren. The Starter plan costs $29 per month, or $23 per month when billed annually.
Built on open standards and measured performance
- eBPF / XDP
- TLS 1.3
- HTTP/2
- OWASP Top 10
- JA3 · JA4
- ACME
- Prometheus
- OpenAPI 3.1
Legitimate requests pass. Malicious requests stop on the way.
Pick a request or type your own. Watch Nexren take it through five checks, live.
Checking the request…
Why was it stopped?
Threat detected: SQL injection
The attacker is trying to send an unwanted command to your database. If successful, customer data can be read, changed or deleted.
942011 Generic SQL Injection Shield
This demo is a simplified simulation of Nexren's real WAF signatures. The rule numbers are real.
Five layers, one panel, one API.
Each layer does its own job and writes its decision to the same event log.
Breakwave (XDP)
Meets attack traffic on the network card's driver path with XDP. A blocked packet never enters the Linux kernel's network stack; the CPU stays free for real visitors.
- 539 ns per blocked packet
- 47% less CPU than iptables
- 100/s SYN per IP (burst 200), 300 connections
Tools that make control easier.
The protection layers work on their own. You decide how each path is protected and when your site goes into maintenance.
Its own protection for every path.
Always keep verification on for your login page, turn bot protection off for your API, give your campaign page a separate mode. Rules are tried top to bottom and the first match applies.
- WAF, bot protection, protection mode and verification per path
- Rate limit per path: requests, window, and what happens when exceeded
- Changes reach the edge servers in 15 seconds
/wp-login.phpVerification: always · rate limit 10 / 60 sActive/api/*Bot protection: off · WAF: onActive/campaign/*Protection mode: under attackOffVisitors shouldn't see an error while you update.
Maintenance mode shows your maintenance page with HTTP 503. It can also turn on by itself when your server stops responding.
- Planned maintenance: set the start and end in advance
- Turns on automatically if the server returns 502 / 504
- Admin IPs skip maintenance and can test the site
SYN 100/s limit
100 SYN per second per IP, up to 200 in a burst.
300 concurrent connections
A single address cannot fill the connection pool.
600+ WAF signatures
Organized by OWASP Top 10 families.
HMAC-chained audit log
A later change breaks the chain.
We measured. We wrote it down. We share it.
Cost to the receiving CPU of each blocked packet in a spoofed-source SYN flood. XDP drops before connection tracking.
Our own measurement · median N=7 · 8 vCPU · 7 Oct 2026
Running protection is as simple as the protection itself.
Billing is predictable; team, notifications and automation live in the same panel.
REST API v1 and MCP
OpenAPI 3.1 definition, Idempotency-Key and MCP tools for AI assistants.
Module-based permissions
Give each member view or edit access only to the modules they need.
Notifications
When an attack starts, your team hears about it on the channel they use.
No bandwidth or overage fees
Your bill doesn't grow when an attack grows. No extra fee for traffic or overage beyond the plan fee.
Get protected in three steps.
Add your site to the panel.
Enter your domain name and your server's address in the panel.
Point your DNS record.
Point the record to the address the panel gives you, as an A record or a CNAME.
Protection turns on.
Once the record propagates, traffic passes through five layers; you follow the decisions from the panel.
Frequently asked questions
Have a question that isn't here? Write to our support team.
You add your site to the panel and point your domain's DNS record to the address the panel gives you, as an A record or a CNAME. Once the record propagates, traffic starts flowing through Nexren.
No extra fee is charged and protection does not turn off. You see a warning in the panel.
No. There are no overage fees for bandwidth or attack traffic; your bill consists of the plan fee only.
REST API v1 comes with an OpenAPI 3.1 definition and supports Idempotency-Key. With MCP tools such as nexren_list_sites and nexren_query_events you can manage your sites from an AI assistant.
Payments are processed securely with 3D Secure.
Guides
- What Is a WAF? How a Web Application Firewall WorksA WAF inspects HTTP requests and blocks attacks such as SQL injection and XSS. Learn signature vs behavioral detection, false positives, limits and tuning.
- DDoS Attack Types: L3, L4 and L7 Differences and DefenseDDoS attacks fall into volumetric, protocol and application classes. See how SYN floods, HTTP floods and slowloris work and how a reverse proxy mitigates them.
- What Is a Reverse Proxy? TLS, Real Client IP and SecurityA reverse proxy sits between clients and your server and takes the traffic first. Learn the DNS change, TLS termination, real-IP headers and trade-offs.
Attacks come from everywhere.Your shield is in Türkiye.
No bandwidth or overage fees. Choose your plan or write to our team.