Contain the abuse.
Keep your API moving.
Choose the path for your API. If it is already connected, open your controls now. If it is new to WebUpCheck, we will guide you through verified setup before any traffic moves.
Open your incident controls.
- Choose the affected hostname and refresh its evidence.
- Use Enforce for your configured automatic rules. Check for legitimate traffic before tightening limits.
- On Protect or higher, restrict a specific caller or start a timed lockdown when appropriate.
Automatic caller restrictions last 60 seconds. Paid manual blocks last up to one hour. Lockdown lasts 5–240 minutes and can exclude legitimate unsigned visitors.
Open incident controls ↗Connect protection safely.
- Register or log in, then add your HTTPS API subdomain and separate origin.
- Prove ownership with DNS and install the provided origin guard.
- Complete the certificate and routing checks, then activate your selected routes.
Free includes automatic caller limits. No card or DNS-provider password is required. DNS propagation and certificate issuance can delay activation.
Start Free setup ↗Know which protection to use.
WebUpCheck targets API request bursts, repeated failed authentication and route probing. Keep your existing firewall and application security in place; full exploit filtering, malware cleanup and unlimited DDoS absorption are outside this service. For a large distributed flood, also use the emergency controls in your existing CDN or WAF.
Keep your application authentication on. Save your current DNS records before changing routing. Review supported traffic and rollback guidance.
Your agent can help contain it.
An already authorized MCP agent can read current restrictions, block or release a caller, adjust route limits, or request a timed lockdown. Management requires Protect or higher. Signing in or adding an MCP server alone does not route traffic through protection.
https://app.webupcheck.com/mcp
Need setup help?
Email support@webupcheck.com. Include your username and hostname, but never passwords, private keys or recovery codes. Support is not a guaranteed 24/7 incident-response service.