Nexren ShieldOpen and measurable security for web applications
Nexren Shield is a reverse-proxy security platform that protects websites, e-commerce infrastructure and critical API endpoints against DDoS attacks, malicious bots and web vulnerabilities.
What is Nexren Shield?
Nexren Shield is a reverse-proxy security platform that sits in front of websites and APIs: every request is evaluated before it reaches your server, first in the kernel with XDP, then by TLS fingerprinting, bot verification and a signature-based WAF. Origin Lock™ makes sure your server can only be reached through Nexren. The Starter plan costs $29 per month, or $23 per month when billed annually.
We meet your traffic before it reaches your server
Your domain's DNS record points to Nexren. Every request to your site first passes through our layers: a kernel-level network filter, an encrypted connection layer and an application layer. Only clean requests are forwarded to your origin server.
We run in a data center in Türkiye; we share our measurements and methods openly.
How we work
Every number on our site rests on a published measurement or a constant in our source code. We publish it together with its method and limits.
No anycast, no Gbps or Tbps capacity promise, no percentage uptime commitment. You decide knowing the conditions under which we operate.
Rules, thresholds and access are managed from a single panel. Everything you do in the panel you can also do with the REST API and MCP.
From our published measurements
Measured on 7 October 2026; a relative comparison on the same virtual server. Method and limits
Layers in operation
Our capacity is limited by this server (8 vCPU, 16 GB RAM) and the hosting provider's network connection.
| Layer | What it does |
|---|---|
| XDP (eBPF), generic mode | Packets from banned addresses arriving on ports 80/443 are dropped before netfilter and connection tracking. The raw/PREROUTING ipset rule remains as a fallback. |
| Breakwave L4 | TCP flag inspection, a per-IP SYN rate limit (default 100/s, burst 200) and a per-IP concurrent connection ceiling (default 300), plus an L7 classifier. SYNPROXY is implemented but off by default. |
| TLS front layer | HTTP/2 support, HTTP/2 (Akamai-style) and JA3/JA4 passive TLS fingerprinting; renewed certificates are loaded without restarting the service. |
| WAF | More than 600 signature rules (regular expressions + input normalization; SQLi, XSS, RCE, LFI, SSRF families). It is not an abstract syntax tree (AST) parser and we have no measurement of its false-positive rate. |
| Bot and CAPTCHA | heuristic bot score, time-locked PoW (WASM) verification, behavioral telemetry and nightly rule evolution. The logistic-regression risk model currently runs with hand-set initial weights and adds at most 30 points to the score. |
| Access and origin | Zero Trust access layer (OTP/TOTP), Origin Lock™ (a shared secret header your origin server verifies + an origin firewall script), country access rules, optional edge static cache per site and team sharing with module-based permissions. |
| Audit | HMAC-chained (tamper-resistant) audit log. |
Contact details
- Headquarters
- Istanbul, Türkiye
- contact@nexren.net
- Payment security
- 256-Bit SSL & 3D Secure Protected Infrastructure
Let's protect your site together
Setup takes a few minutes. For your questions, our team is with you every weekday.