CerberusWaf is a managed Web Application Firewall that protects hundreds of websites from one panel. Point your DNS, we handle the rest — real-time threat detection, anti-bot challenges, IP intelligence, and a SOC-grade dashboard.
40+ security modules. Domain-first interface. Multi-tenant. Managed or self-hosted.
Put /wp-admin, an internal panel or a whole site behind identity. Users sign in with their company account (Microsoft Entra ID, Google Workspace or any OpenID Connect provider) or a one-time code by email, and you can allow only authorized devices with a client certificate. The WAF verifies a signed session on every request before anything reaches your origin. No VPN, no agents, no changes to your app.
EnterpriseHow it works →12-phase request pipeline with pattern matching for SQLi, XSS, RCE, path traversal, SSRF, and scanner detection. Audit or block per domain.
FreeJavaScript Proof-of-Work challenge with Web Worker computation and HMAC cookie verification. Under Attack mode forces challenge for all visitors.
Starter+Multi-source threat feeds (AbuseIPDB, VirusTotal). Reputation scoring, Tor/VPN/proxy detection, and auto-block by threat level.
ProfessionalPre-built catalogs for WordPress, WooCommerce, Magento, Laravel, APIs. Pentesting-derived rules for RCE, SSRF, file uploads.
FreePer-domain limits with progressive penalties. Presets for API, login, and general traffic. Burst and connection control.
FreeCountry-based access control with local GeoIP database — 312K+ ranges, sub-millisecond lookup. Allow, deny, challenge, or log.
ProfessionalMatch IP, country, User-Agent, referer, URI path. Time windows, day-of-week schedules, and HTTP method filtering.
ProfessionalWorld map attack visualization, real-time threat timeline, top attacking IPs with WHOIS, and one-click block/whitelist.
ProfessionalAuto-import domains from remote servers via SSH. Supports Nginx, cPanel, Apache, Plesk with bulk import and deduplication.
BusinessAutomated certificate management with Let's Encrypt. Custom upload, auto-renew, and bulk renewal across all domains.
FreeProxy cache with TTL, purge, gzip. Load balancer with round-robin, least-conn, ip-hash. Health checks with auto-failover.
ProfessionalClient management with domain limits, user roles (superadmin, admin, client), 2FA/TOTP, and full audit trail.
ProfessionalEvery request to a protected path must prove who is asking. CerberusWaf checks identity at the edge, then still runs the full WAF pipeline, so a stolen password or an exposed admin panel is no longer an open door.
An app is a path on your domain: /wp-admin/, /admin, /erp/ or / for the entire site. Several apps per domain, each with its own policy and session length.
Allow individual emails or whole email domains. Skip login for trusted networks such as your office or monitoring. Deny by email, IP / CIDR or country, even with a valid session.
Visitors without a session get a branded sign-in page. They use their company account through single sign-on — Microsoft Entra ID, Google Workspace or any OpenID Connect provider, with PKCE and a signature-verified ID token — or a 6-digit code by email that expires in 10 minutes. Each app chooses SSO, code or both.
Each domain gets its own certificate authority. Issue a client certificate per laptop from the panel and mark an app “require authorized device”: it only opens on machines that present that certificate over mutual TLS, and the session is bound to the device, so a stolen cookie is useless elsewhere. Everyone else visiting the site notices nothing.
A signed, HttpOnly session cookie is checked by the WAF engine in microseconds, without a database round-trip. Your origin receives the verified user in X-CWAF-User-Email.
IP whitelists, CMS session bypasses and whitelisted URLs cannot skip the login. Only the network rules you write for that app can.
Signed-in users keep going through blacklists, GeoBlock, IP Intelligence, rate limits and WAF rules. Identity never means trust by default.
Remove a user, end a single session or sign everyone out with one click. It takes effect on the next request, not when the cookie expires.
Code requests and attempts are rate-limited per IP and per email, and the sign-in page never reveals which emails have access.
The verified email is forwarded to your origin and client-supplied copies are overwritten. Authenticated responses are never cached.
Microsoft Entra ID, Google Workspace or any OpenID Connect provider. Your allow and deny rules still decide which accounts get in.
Per-domain certificate authority, client certificates issued from the panel and mutual TLS at the edge. Only enrolled laptops open the app.
Revoke a laptop and it is locked out on the next request, together with every session opened from it.
Code requests, sign-ins, wrong codes and denials appear in WAF events, plus a live list of active sessions per domain.
Available on Enterprise, including single sign-on and authorized devices. Coming next: signed JWT for your apps and service tokens for machine-to-machine traffic.
Talk to Sales →Your traffic flows through our Nginx reverse proxy with an auth_request-based WAF engine. Every request passes through 14 security checkpoints before reaching your origin.
Change your DNS to CerberusWaf. We handle SSL, caching, and security automatically.
14-phase pipeline: bot check, IP intel, ACL, rate limit, pattern matching — all in <1ms.
Block (403), challenge (JS PoW), log (audit), or pass. Per-domain config.
Clean traffic proxied to your origin with load balancing, caching, and health checks.
Most WAFs run every check on every request. CerberusWaf's pipeline is ordered cheapest-first: if a request is blocked at phase 2, phases 3–12 never execute. This cascade architecture dramatically reduces server load.
UA flags, Offline mode, Bot cookie, IP white/blacklist — simple lookups in memory. An IP blacklist match at phase 5 blocks the request in ~0.01ms. No regex, no DB query, no bandwidth to origin. This alone stops 40–60% of malicious traffic.
GeoBlock, IP Intel, Rate Limit, ACL, CMS Auth — fast indexed lookups and counters. GeoBlock uses a local 312K-range database (sub-ms). Rate limiting uses in-memory counters. These catch 20–30% more threats before the expensive regex runs.
WAF Rules + Rulesets — regex pattern matching for SQLi, XSS, RCE, path traversal. This is the most CPU-intensive phase, but by now 60–80% of bad traffic has already been blocked. Only clean-looking requests pay the full analysis cost.
Select a domain, everything contextualizes. Auto-cycling preview — hover to pause, click tabs to explore.
Real interface screenshots from the CerberusWaf management panel.
Start free, scale as you grow. No per-request fees, no bandwidth limits.
6–10 domains: 10% off · 11–25: 20% off · 26–50: 30% off · 51+: custom pricing
Custom pricing for large-scale deployments. Identity-based access to admin panels and internal apps, with single sign-on (Microsoft Entra ID, Google Workspace, OpenID Connect) and device verification by client certificate. Dedicated support with 1h SLA.
All plans include SSL, security headers, and basic auth. Annual billing saves 20%.
No installation. No server configuration. Just sign up, add your domain, and update your DNS.
Your traffic is proxied through CerberusWaf's infrastructure across datacenters in Miami, Tampa, and Santiago. We handle Nginx, SSL certificates, GeoIP databases, threat feeds, and all security updates.
Start free with 5 domains. Upgrade as you grow. No server to manage, no installation required.