Interactive dashboard
Requests, blocks and unique IPs in real time, with hourly charts and a breakdown by traffic type.
Inline WAF · No proxy · No DNS
Protect your site from attacks. Don't lose sales.
CoreWAF blocks bots, attacks and junk traffic from inside your own site.
No credit card · Setup in minutes · Cancel anytime
How it works
Under Attack mode
Under active attack, block all traffic in one click except your whitelist. Turn it off when the storm passes.
Bots & AIs under control
Classifies every visit: bots, crawlers, scrapers, AIs and search engines. See who comes in and block the rest.
Rules your way
Block by IP, CIDR, User-Agent or URL with exact operators: contains, starts, ends and exact.
Priority whitelist
Whatever you mark as legit is never blocked, no matter what. One click to unblock.
Top IPs, URLs & countries
See where traffic and attacks come from: top IPs, User-Agents, URLs and countries.
Ready-made rules
You start protected: preset rules against known bots, attacks and abuse, updated daily.
Quality support
Real people who know the product. We help you set things up and stop attacks when it matters.
API and MCP server
Automate from your code with the API, or connect your WAF to Claude and other AI assistants over MCP.
What makes us different?
No DNS changes · No proxy mode.
Traditional proxy WAF
Intercepts traffic before it reaches your server
Other WAF and CDN providers
- You lose DNS control and add slow wait times
- If the provider goes down, your site goes down
- Generic rules with a high false-positive rate
- You lose access to logs — you depend on your provider
- SSL certificate management under third-party control
- Incompatible or problematic when combined with other CDNs
CoreWAF inline
Runs inside your application, no intermediaries
Your server remains the sole entry point
- Set up in minutes
- No DNS changes, no infrastructure dependencies
- Fail-open by design: if it fails, traffic passes through
- Metrics based on actual traffic received by your application
- Compatible with any CDN: Cloudflare, Fastly, BunnyCDN…
One plan. Everything included.
Everything included
50 M
requests / mo€5.00 /mo
or €50 a year — two months free
- 50 M requests analysed per month
- Unlimited rules: IP, range, country, URL and User-Agent
- Under Attack mode with your own patterns
- Bot and AI crawler control
- Real-time analytics with 31 days of history
- Public API and MCP server
- No lock-in: cancel whenever you want
Need more than 50 M a month? Write to us and we will sort it out. Contact
FAQ
Frequently asked
Does it work if I already have Cloudflare or Sucuri in front?
Yes. CoreWAF lives inside your site, not at the edge, so they coexist without conflict. In fact, CoreWAF gives you real data of what your site received after the CDN filter — something the Cloudflare panel doesn't show.
How long does setup take?
Minutes. Sign up, add the domain, paste a single line in your site. No DNS, no migrations, no restarts.
Are there false positives?
Only blocks what you define. There are no aggressive global rules like a stock OWASP CRS. If a legitimate IP or User-Agent gets caught, you whitelist it in one click and it overrides any blacklist.
What if I go over the requests in my plan?
We email you at 70%, at 90% and when you hit 100%. At 100% your site stays online but the WAF stops filtering until the next cycle: we never take your site down. With 50 M a month most sites have plenty of room.
Can I pay yearly?
Yes: €50 a year instead of €60. That is two months free and a single charge. You can switch from monthly to yearly whenever you want; it applies on your next renewal.
What is the MCP server?
MCP is the standard AI assistants use to connect to external tools. Connect your CoreWAF token to Claude (or any compatible client) and ask it in plain language to block an IP, tell you who is attacking you, or turn on Under Attack.
What happens if CoreWAF stops responding?
Fail-open by design: if the WAF logic fails, your site keeps serving traffic as if it weren't there. Blocking real visitors is worse than not blocking attacks for a minute.