What Is Nexren Shield? A Reverse-Proxy Web Security Service

What is Nexren Shield?

Nexren Shield is a reverse-proxy security service that sits between the internet and your website or API. Visitors connect to Nexren first, not to your server. The service inspects each request, filters out attacks and malicious bots, and forwards the legitimate request to your server.

In one sentence: you change a DNS record, and your traffic passes through a security filter. For the basic setup you do not change application code or install an agent; you only touch your web server and firewall if you also want to lock down the origin. If the reverse-proxy idea is new to you, start with what is a reverse proxy.

What does it do?

The service does four jobs:

• WAF: it catches attack families such as SQL injection, XSS, remote command execution, local file inclusion and SSRF with signature rules. See what is a WAF for detail.
• DDoS mitigation: it drops banned addresses at kernel level, limits SYN rates and connection counts, and watches flood thresholds at L7. The guide on DDoS attack types covers the classes.
• Bot verification: it tests whether a client is a real browser with a proof-of-work puzzle that asks for no image selection and no clicking.
• Zero Trust access: it puts e-mail OTP or TOTP verification in front of an application or a path.

On top of these come custom WAF rules, country and path rules, per-IP and per-path rate limits, an optional edge cache, Slack/Discord/Telegram/e-mail alerts, a REST API and an MCP server.

Why protect through a reverse proxy?

Making the security decision in front of the application takes less effort than writing protection code into every application. You write rules in one place and watch events in one panel. A blocked request never reaches your origin, so it spends none of your CPU or database connections.

There is a price: the proxy becomes a dependency on your traffic path. The reverse-proxy guide covers how the real client IP reaches your origin, how WebSockets behave and what happens if the proxy is down. You should accept that trade-off knowingly.

Who is it for?

Nexren Shield targets teams that run a web application or API on their own server and want to add a security layer with a DNS change. It suits small and mid-sized sites, SaaS products, services that receive webhooks, and teams that do not want an admin panel open to everyone.

How does it work, from DNS to origin?

The flow is:

1. Add your domain and origin IP in the panel.
2. Prove you own the domain with a TXT record named _nexren-challenge.
3. Point a CNAME (or A) record at the Nexren edge address shown in the panel.
4. Once DNS propagates, a TLS certificate is issued automatically. The guide on automatic SSL with Let's Encrypt explains the process.

After that, a request passes these layers:

A legitimate request that clears these layers reaches your origin. To close the origin to direct access, follow origin IP hiding and Origin Lock.

Plans

There are three plans. Starter gives a 5 million request monthly quota and Pro gives 25 million; Enterprise has no monthly quota and is quoted by contract. Event-log retention is 30, 90 and 365 days respectively. The quota counts only requests forwarded to your origin. Manual Under Attack mode, a manual RPS threshold, permanent attack mode, maintenance mode and System Analysis exist only on Pro and Enterprise; every other feature is on every plan. A subscription is per site. See the pricing page for prices.

Limits

What you should know before you buy:

• Single region, single server. The service runs on one virtual server (8 vCPU, 16 GB RAM) in Turkey. There is no multi-region edge network.
• No anycast, and no upstream scrubbing service.
• No bandwidth promise. If a volumetric attack saturates the provider line, the line can choke before traffic reaches the server. We publish no capacity figure.
• No percentage SLA. The Terms of Service contain a service-level target; it is not a commitment. Maintenance can cause short interruptions.
• The WAF is regex-based. It does not parse input into a syntax tree and can miss new or obfuscated attack forms.
• We have not measured the false-positive rate. Watch a new site in Monitor mode first.
• Origin isolation depends on a step you take. L3/L4 isolation holds only if you run the origin firewall script.

If these limits do not fit your threat model, write to us before buying.

Next steps

If you are choosing a WAF, use the list of 10 questions to ask when choosing a WAF. For the bot side, read bot protection and CAPTCHA alternatives. The help page covers setup questions.

Sources

• OWASP Top 10
• RFC 4987: TCP SYN Flooding Attacks and Common Mitigations
• Let's Encrypt documentation

Related product pages:Technology Pricing