Nexren ShieldWhy these ten questions?
Buying WAF, DDoS and bot protection means routing all your traffic through a third party. The decision is therefore less about the feature list than about trust and limits. The questions below can be put to any provider. For each you will find why it matters, what a good answer looks like, and Nexren Shield's own answer.
This guide does not score providers or compare them with anyone. The aim is to equip you to make your own decision. For basic concepts, see what is a WAF and what is a reverse proxy.
1. Where does TLS terminate, and who holds the keys?
Why it matters: A protection provider decrypts HTTPS traffic to inspect it. That means the provider briefly sees everything your visitors send in clear text.
A good answer: It states the termination point, where the private key lives, who obtained the certificate, and whether the connection between proxy and origin is encrypted.
Nexren Shield's honest answer: TLS ends at our front layer, and because we obtain the certificate, the private key sits on our server. The certificate is issued automatically from Let's Encrypt over HTTP-01; wildcards are not supported. More: automatic SSL.
2. What is the capacity, and how is it evidenced?
Why it matters: Phrases like "terabit scale" mean nothing without a method. What limits capacity is often the provider's own uplink.
A good answer: The number comes with environment, method and limits, and what was not measured is said to be unmeasured.
Nexren Shield's honest answer: One region, one virtual server (8 vCPU, 16 GB). There is no anycast, no multi-region network and no upstream scrubbing, and we make no Gbps or Tbps promise. We measured only relative CPU cost (same VM, veth, generic XDP); line rate and IPv6 were not measured. A volumetric attack that fills the line can choke it at the provider level. See DDoS types.
3. How do you handle false positives?
Why it matters: A WAF that blocks a legitimate customer can cost more than the attack. Every signature-based system produces some false positives.
A good answer: A non-blocking monitor mode, per-rule exceptions, a record showing why something was blocked, and either a measured rate or an honest statement that it is unmeasured.
Nexren Shield's honest answer: Monitor mode detects and logs without blocking. Custom rules and rule exceptions exist. The WAF uses 600+ signature rules and is regex-based; its false-positive rate has not been measured.
4. Where is data stored, and for how long?
Why it matters: IP addresses and request details can be personal data. Location and retention shape your compliance duties.
A good answer: It lists the fields processed, what happens to request bodies, the location, the retention period and the deletion method.
Nexren Shield's honest answer: Processed fields are IP, port, protocol, time, User-Agent, method and URL; bodies of legitimate requests are not stored. Data sits in Turkey on a single virtual server and is not sold. Event-log retention is 30 days on Starter, 90 on Pro and 365 on Enterprise. More: KVKK, GDPR and logs and the privacy page.
5. How is the origin protected?
Why it matters: If an attacker finds your origin IP and connects directly, the protection layer never comes into play.
A good answer: A mechanism lets only the provider reach the origin, and its limits are explained.
Nexren Shield's honest answer: Origin Lock adds a secret header with a random name to every request; your web server rejects requests without it with a 403. A firewall script opens 80/443 only to Nexren edge addresses. L3/L4 isolation holds only if you run the script. More: origin lock.
6. How are bots and APIs handled?
Why it matters: Bot verification is designed for browsers; API, webhook and mobile clients cannot solve a verification page.
A good answer: It names the signals behind bot detection, admits that it can be evaded, and offers separate profiles or exclusions for APIs.
Nexren Shield's honest answer: The bot layer uses a heuristic score, proof-of-work and behavioral data; the check has no images and no clicks. Bypasses were found in internal bot test matrices, so we do not claim 100%. Clients that cannot run JavaScript are blocked. For APIs there are traffic profiles (api, webhook, realtime), per-path 429 limits and REST API v1. See bot protection and API security.
7. How do incidents and support work?
Why it matters: Attacks arrive at midnight. You should know in advance who responds, when, and through which channel.
A good answer: Support hours, channel, target response time, and what any percentage commitment actually is.
Nexren Shield's honest answer: Support is by e-mail and ticket on weekdays 09:00-18:00; automatic threat monitoring runs continuously, but there is no 24/7 human support. There is no percentage uptime SLA; the Terms contain a service-level target, and maintenance can cause short interruptions. Alerts go to Slack, Discord, Telegram or e-mail.
8. Can I get logs, exports and an API?
Why it matters: Post-incident review and moving data into your own SIEM require programmatic access to records.
A good answer: Retention, a query interface, API scopes and audit-log integrity are documented.
Nexren Shield's honest answer: REST API v1 (OpenAPI 3.1, scoped tokens) and an MCP server exist; the MCP server has an event-query tool and permissions match the panel. We make no separate commitment about an export format. The audit log is chained with HMAC-SHA256. Event-log retention is 30/90/365 days by plan.
9. What happens if I want to leave?
Why it matters: The cost of dependence is invisible at signing. A protection layer without an exit plan turns into lock-in.
A good answer: Steps to point DNS back at the origin, how certificates and firewall rules are reverted, and cancellation terms.
Nexren Shield's honest answer: You point your DNS record back at your origin. The firewall script's
--revertoption undoes its rules. You can cancel from the panel at any time for subsequent terms; service stays active until the end of the paid period. Before switching DNS, make sure your origin has a valid certificate.
10. How do pricing and quota overage work?
Why it matters: Attack traffic can inflate a bill. A protection that switches off when the quota fills would be an unacceptable surprise.
A good answer: It states what is counted, what happens when the quota fills, and how attack traffic affects billing.
Nexren Shield's honest answer: Subscription is per site (1 domain). The quota counts only requests forwarded to your origin. When it fills there is no extra charge and protection does not switch off; the panel shows a "Kota Doldu" (quota full) warning. Prices include 20% KDV; there is no free trial. Current plans are on the pricing page.
Summary table and a note on Nexren Shield
| # | Question | What to look for |
|---|---|---|
| 1 | TLS and keys | Termination point, key owner, origin link |
| 2 | Capacity | Measurement with method, stated limits |
| 3 | False positives | Monitor mode, exceptions, measured rate |
| 4 | Data and retention | Fields, bodies, location, period |
| 5 | Origin protection | Header or firewall, its limits |
| 6 | Bots and APIs | Admission of evasion, API profiles |
| 7 | Incidents and support | Hours, channel, nature of the commitment |
| 8 | Logs and API | Programmatic access, integrity |
| 9 | Exit | DNS rollback, cancellation terms |
| 10 | Pricing and quota | Unit counted, behavior when quota fills |
Ask for the answers in writing and try a monitoring period with your own traffic. For questions about Nexren Shield use contact, and for a definition of the product read what is Nexren Shield.
Sources
Related product pages:Pricing Technology
Frequently asked questions
What should I check first when evaluating a WAF provider?
Start with where TLS terminates and who holds the key. That sets how much of your traffic the provider sees and where the trust boundary sits.
Can I trust a capacity number?
Not unless it says how it was measured. Ask for the test environment, method and limits; a Gbps or Tbps claim without evidence is a warning sign.
How hard is it to switch providers?
In most setups, pointing DNS back at the origin is enough. The real questions are whether your origin stays exposed during the exit and how you will manage certificates.
Why does monitor mode matter?
It lets you see false positives on live traffic without blocking anyone. It gives you a trial period before you switch to blocking.
Does Nexren Shield have a free trial?
No, there is no free trial. Accounts are opened by our team; the subscription is per site and can be cancelled from the panel at any time for subsequent terms.
Related guides
What Is a WAF? How a Web Application Firewall Works
A WAF (web application firewall) inspects the HTTP requests headed for your application against a set of rules and blocks attacks such as SQL injection and XSS before they reach the app.
What Is a Reverse Proxy? TLS, Real Client IP and Security
A reverse proxy is an intermediary that clients connect to and that forwards requests to the server behind it.
What Is Nexren Shield? A Reverse-Proxy Web Security Service
Nexren Shield is a reverse-proxy security service that sits in front of your web applications.
Hide Your Origin IP and Lock the Origin: Leaks and Fixes
The origin IP is the real address of the server behind your reverse proxy.