See the behavior.
Request bursts, configured request budgets and repeated 404 route probing. Concrete rules, with recorded reasons.
WEBUPCHECK PROTECT / EARLY ACCESS
Give good traffic
room to work.
Put clear limits in front of your API. Catch request bursts and repeated probing. Restrict the caller for 60 seconds, while other callers keep moving.
No card for Free. One API subdomain. You control the policy.
SELECTIVE BY DESIGN
Good userPass →
Good agentPass →
Burst callerWait 60s
YOUR APIOne caller pauses.
The rest keep working.
The rest keep working.
Illustration of caller isolation. Shared public IPs can share a budget. Availability is not guaranteed.
Contain the caller.
Temporarily reject matching requests before they reach your origin. A fixed 60-second restriction, then automatic recovery.
Respond your way.
Review evidence, release a caller or switch to observe mode. Use the dashboard, or delegate scoped controls to your agent.
TWO WAYS TO OPERATE
↳ PEOPLE & AGENTS
↳ PEOPLE & AGENTS
A clear view.
For people.
Register, connect your API and see exactly what is enforcing. Check recent events, review active restrictions and change mode without an agent.
- Guided DNS and origin checks
- Caller-specific restriction release
- Scheduled origin observations, about every 5 minutes
Useful controls.
For agents.
Use an authenticated REST API or remote MCP server to read status and events. Protect adds policy changes, caller release and private traffic credentials.
- Free read access to your own protection evidence
- Scoped, revocable keys with 30-day expiry
- Separate one-hour traffic credentials on Protect
START SMALL
↳ FIXED PLAN PRICES
↳ FIXED PLAN PRICES
Clear limits.
No surprise customer overages.
FREE / START WITH ONE API
Free
$0 / month
Prove the setup on a small API.
- 1 API subdomain and 1 origin
- 1 protected route prefix
- 30 requests/10s; 120 requests/60s per caller & route
- 60-second caller restrictions
- 50,000 requests/month with event history
- 24-hour event retention
- Dashboard controls + API/MCP read access
No card. No automatic paid upgrade.
PROTECT / MORE CONTROL
Protect
$39 / month · USD
For operators and incident-response agents.
- 1 API subdomain and 1 origin
- Up to 10 protected route prefixes
- Configurable per-route budgets through the API
- 60-second caller restrictions
- 1,000,000 requests/month with event history
- 30-day event retention
- API/MCP management + traffic credentials
- Signed application webhooks
Paid activation opens after live billing validation. No payment is collected during the test phase.
Protection does not switch off at the history allowance. Behavioral blocking continues. New detailed events and corresponding webhook notifications pause until the monthly reset or an upgrade. No automatic customer overage charges. This early-access service has shared capacity and fair-use limits; it is not an unlimited DDoS absorption or uptime guarantee.
CONNECT ONCE
↳ GUIDED SETUP
↳ GUIDED SETUP
From Register
to connected.
Register. Save your recovery codes.
Create a passkey account. No card, no DNS provider credentials. Login returns you to your dashboard.
Add your API and prove ownership.
Enter the API subdomain, a separate HTTPS origin and the route to protect. Copy the TXT record into your DNS provider, then select Check ownership.
Lock the origin.
Install the provided origin guard before all API routes. Only requests with your private origin key should reach the application. The dashboard tests both allowed and denied access.
Prepare HTTPS. Change the CNAME.
Complete the displayed certificate records. Save your old DNS record, point the API subdomain to the supplied target, then select Test routing & activate. Allow a brief setup window during cutover.
Test, then optionally connect your agent.
Confirm normal requests pass and a controlled burst is restricted. Create a read key for evidence, or a Protect management key for incident actions. MCP is optional; protection works without an agent.
Need to roll back? Switch to observe to stop behavioral blocking, or restore your saved DNS record to bypass the gateway. Keep application authentication intact. Origin-guard removal is a separate deliberate step after routing has been restored.
KNOW THE BOUNDARIES
↳ BEFORE YOU CONNECT
↳ BEFORE YOU CONNECT
Focused protection.
Honest scope.
Designed for
Verified HTTPS API subdomains, a single origin, and selected path prefixes. GET, HEAD, POST and OPTIONS. Requests up to 64 KiB, responses up to 1 MiB, origin response within 10 seconds.
Outside v1
Root domains, WebSockets, server-sent events, file uploads and long-running streams. Full OWASP exploit filtering, malware cleaning, application authorization, guaranteed uptime and a managed security team are not included.
How rules work
Free restricts a caller after more than 30 requests in 10 seconds, more than 120 in 60 seconds, or four 404 responses in 60 seconds on a selected route. A restriction lasts 60 seconds; blocked retries do not extend it. Protect supports configured budgets, not measured CPU billing.
Caller identity
Anonymous callers share limits by public source IP. This can affect users behind the same network. Protect traffic credentials separate budgets for known callers; they do not prove an agent is safe or bypass rules. Slow or distributed abuse can evade these caller-based rules.
Evidence, not certainty
Behavior rules can produce false positives. Origin observations are one perspective, not multi-region tests. Retention and allowances limit history. A quiet event log does not establish that no attack occurred.
Is this a firewall?
It is a reverse proxy with behavioral rate and route-probing controls. It is not a complete web application firewall and should not be described as full OWASP protection. Keep your application security, authentication and existing infrastructure controls.
Does MCP detect or block the attack?
No. Traffic passes through the protection gateway, which evaluates the rules. MCP gives an authorized agent a standard way to read evidence and request permitted actions. The REST API exposes the same account-scoped controls to code and dashboards.
Do you need my DNS provider password?
No. You add the supplied DNS records yourself and install the origin guard. WebUpCheck verifies ownership and routing. Never send provider passwords, origin secrets or management keys to public agents.
Do you use a database of attackers?
We store account settings, short-lived caller state and retained events. No external attacker reputation feed is currently used for blocking. Future feeds need source, license, confidence, expiry and freshness checks; a shared IP on a list is not sufficient evidence to block a customer.
START WITH YOUR OWN TEST API