How can we help you?

Add your domain and origin IP in the dashboard. Point your DNS A or CNAME record to the designated Nexren Edge IP. Once DNS resolves to our edge, your Let's Encrypt SSL is automatically issued and WAF protection activates immediately.

If attackers discover your real server IP through old DNS records or email headers, they can bypass the CDN and WAF layer and attack your server directly. To prevent this, lock ports 80 and 443 so that only the Nexren Shield IP address is allowed, by running the protect-origin.sh script offered in the Origin settings tab or with UFW/firewalld.

Origin Lock carries a secret shared between Nexren Shield and your origin server in a dedicated request header. Your web server (Nginx/Apache/PHP) immediately rejects any request lacking this valid header with a 403 Forbidden.

Yes! Nexren Shield runs an automated background scheduler that monitors SSL expiration across all domains. When a certificate has 15 or fewer days remaining, ACME renewal triggers automatically with zero downtime.

Enable Under Attack mode during heavy Layer 7 volumetric HTTP floods or distributed bot attacks. All visitors receive an automatic browser verification; real browsers usually pass within a few seconds, while automated clients that cannot run JavaScript or solve the puzzle are blocked.

Subscriptions are per site: each subscription covers a single domain. For more domains you need a separate subscription for each.

Our team opens accounts; send an account request through the contact form. We do not offer a free trial.

Point either a CNAME or an A record at the Nexren Edge address shown in the panel. At the zone apex (for example example.com) standard DNS does not allow a CNAME, so use an A record there or look for your provider's CNAME flattening feature.

The panel gives you a _nexren-challenge TXT record to create on your domain. Once the record is visible in DNS, ownership is verified.

Yes, all published prices include 20% VAT (KDV).

Annual billing lowers the monthly price by 20%: Starter is $23 instead of $29 and Pro is $71 instead of $89 per month (monthly equivalent; TRY: ₺710 instead of ₺890 and ₺1,990 instead of ₺2,490). Enterprise is a custom quote.

There is no extra charge and protection does not switch off; the panel shows a "quota exceeded" warning. Only requests forwarded to your origin count toward the quota, not blocked attack requests.

Retention depends on the plan: 30 days on Starter, 90 days on Pro and 365 days on Enterprise.

Manual Under Attack mode, the manual RPS threshold, permanent attack mode, maintenance mode and System Analysis are available on Pro and Enterprise only. Every other feature is available on every plan.

Cancel any time from the customer panel, with no extra fee or penalty. The service stays active until the end of the period you paid for and does not renew for the next one.

Payments are processed securely with Visa, Mastercard and Troy cards, using 3D Secure verification.

Origin Lock is available on every plan. Nexren adds a secret header to each request; your origin server verifies it and rejects requests without it with a 403.

Yes. The script shows the planned rules without changing anything with --dry-run and removes the isolation it applied with --revert. If SSH runs on a non-standard port, pass it with --ssh-port.

Certificates are issued automatically by Let's Encrypt using the HTTP-01 challenge and renewed 15 days before expiry; the new certificate loads without a service restart. Wildcard (*.) certificates are not supported with HTTP-01.

Yes. When a flood is detected, the site switches to verification mode automatically on every plan. Manual Under Attack mode and permanent attack mode are available on Pro and Enterprise.

Background clients that are not browsers cannot show the puzzle; they receive a JSON 403 asking for a reload instead of HTML. We recommend defining API and webhook paths as a traffic profile or excluded path.

It adds an access layer in front of a path or app that asks for an e-mailed one-time code (OTP), a TOTP code or both; you can set an IP allow-list and excluded paths. The layer protects HTTP(S) apps; it does not protect SSH or database ports.

Request bodies of legitimate traffic are not stored persistently or passed to analytics tools. The infrastructure and data are hosted on a virtual server in a data center in Turkey; details are on the Privacy and KVKK page.

Yes: REST API v1 (OpenAPI 3.1, scoped tokens) and an MCP server with six tools. The default rate limit is 120 requests per minute per token; details are at apidocs.nexren.info.

Switch the protection mode to Monitor to record suspicious requests without blocking them, review the logs and add a custom rule. The WAF uses regular-expression signatures and we have not measured its false-positive rate, so we recommend watching a new site in Monitor first.