Serve your site through our network
Serve your site through our network with free SSL, a managed firewall, Under attack mode and traffic analytics. Pro adds custom firewall rules and cache settings.
Edge Proxy puts your site behind our network. It serves HTTPS with a free certificate, checks every request with a firewall and passes the good ones to the server that runs your site.
- HTTP/3 over QUIC, beside HTTP/2 and HTTP/1.1
- TLS 1.3 and TLS 1.2, with older versions refused
- 100 names on one free certificate
- Free certificates for every site, renewed for you
Edge Proxy on each plan
Edge Proxy comes with every plan. Your plan sets how many websites it serves and which controls you get.
Free
Free certificates, the managed firewall and caching.
- 3 websites
- Free SSL certificates
- The managed firewall
- Caching of static files
Pro
Custom firewall rules, cache settings and your own certificates.
- 10 websites
- 20 custom firewall rules
- Cache settings, and clearing the cache
- Your own certificates and wildcard certificates
Business
Rate limiting rules and country rules.
- 50 websites
- 100 custom firewall rules
- 10 rate limiting rules
- Country rules, which match a visitor’s country
The Free plan’s websites include DNS, certificates and protection on our network. The site itself runs on a server you pay for, on hosting you already have, or as a static site on our edge.
Compare every plan · Talk to sales about Enterprise
Technical specifications
What the edge speaks, what it checks and what it keeps, on every plan unless a row names one.
| Protocols | |
|---|---|
| Visitor connections | HTTP/3 over QUIC on UDP port 443, HTTP/2 and HTTP/1.1 |
| TLS versions | TLS 1.3 and TLS 1.2. The edge refuses SSL 3.0, TLS 1.0 and TLS 1.1 |
| TLS 1.2 cipher suites | ECDHE key exchange with AES-GCM or ChaCha20-Poly1305, so every connection has forward secrecy |
| WebSockets | Passed through to your server when you turn WebSockets on |
| Certificates | |
| Issuing | Free, over ACME, with DNS or HTTP validation |
| Renewal | Automatic, when 30 days are left |
| Names on one certificate | Up to 100 |
| Wildcard certificates | Pro and up |
| Your own certificate | Pro and up |
| New certificates in a week | Each certificate authority limits them for one registered domain, and the SSL/TLS tab shows how many you have used |
| Firewall | |
| Managed rules | SQL injection, cross-site scripting, command injection, path traversal, server-side request forgery, XML external entities, header injection and vulnerability scanners |
| Request body the rules read | The first 64 KB, without uploaded files |
| Human check | A browser that passes is not asked again for 20 minutes, while its IP address stays the same |
| Custom rules match | IP address (one address or a range, IPv4 or IPv6), path, query string, method, user agent, referrer and cookie, and country on Business and up |
| Custom rules on each plan | 20 on Pro, 100 on Business and 1,000 on Enterprise |
| Rate limits (Business and up) | 1 to 100,000 requests in 10 seconds, 1 minute, 10 minutes or 1 hour, then 429 Too Many Requests |
| Under attack mode | Asks each visitor a simple math question before a page opens, and refuses scripts and API clients that send no browser headers |
| Hotlink protection | Answers 403 to a picture whose request names another site as its referrer |
| Traffic analytics | |
| What is counted | Requests, blocked requests, data served and errors from your server, by hour and by hostname |
| History | 24 hours on Free, and 7 and 30 days on Pro and up |
| Cache | |
| What the edge caches | Images, fonts, audio and video. HTML pages are never cached. |
| Largest file | 10 MB |
| How long a copy stays | The origin’s s-maxage or max-age, or 1 hour when it sends neither |
| Response header | X-Cache: HIT from the cache, MISS from your server |
| Cache settings and clearing | Pro and up |
| Origins | |
| Origins | One or more, at any public address. Each request goes to the one with the fewest requests in progress. |
| Origin protocols | HTTP/1.1 or HTTP/2, with or without TLS |
| Retries | GET, HEAD and OPTIONS tried twice on each origin |
| Headers your server gets | X-Forwarded-For, X-Real-IP and X-Forwarded-Proto |
| PROXY protocol | Version 2, when you turn it on |
| API | |
| Client API | Create web proxies, redirect rules, error pages and firewall rules over HTTPS with an API token |
What Edge Proxy includes
Each feature says whether every plan includes it or which plan adds it.
Security
- A managed firewall. Included. Rules we keep up to date check each request for SQL injection, cross-site scripting, path traversal and other common attacks before it reaches your server. A request with a high score gets 403. One that still looks suspicious gets a check that asks the visitor to confirm they are human.
- Custom firewall rules. Pro and up. Block or challenge requests that match an IP address, a path, query string, method, user agent, referrer or cookie. Pro includes 20 custom firewall rules, Business 100 and Enterprise 1,000. Your rules run before the cache and the managed rules.
- Block an IP address. Pro and up. Stop the requests from one address or a range of addresses, IPv4 or IPv6. A rule can also let in every address except the ones you list. An address rule is a custom rule, so it counts toward your plan’s rules. Block an IP address
- Rate limiting rules. Business and up. Count the requests each visitor’s address sends in a window from 10 seconds to 1 hour, and answer 429 past your limit. Business includes 10 rate limiting rules and Enterprise 100.
- Country rules. Business and up. Match the country a request comes from, and block or challenge it.
- Under attack mode. Included. While automated requests flood a site, ask each visitor a simple math question before a page opens. Turn it off when the attack ends. A visitor who answers is not asked again for 20 minutes in that browser. Scripts, API clients, webhooks and uptime monitors that send no browser headers are refused while it is on. Under attack mode
- Hotlink protection. Included. Stop other sites from showing your pictures and using your bandwidth. A picture asked for by a page on another site gets a 403. A visitor who opens a picture directly still gets it. Hotlink protection
Traffic
- Traffic analytics. Included. See how many requests each hostname answered, how many our network blocked, how much data it served and when your server returned errors. The Free plan shows the last 24 hours. Pro and up also show 7 and 30 days. View a website’s traffic
HTTPS
- Free certificates. Included. We issue a certificate for each name your site answers on, and renew it when 30 days are left. One certificate covers up to 100 names.
- Wildcard certificates. Pro and up. One certificate for every name directly under a domain, such as *.example.com, proved through a TXT record in our DNS.
- Your own certificates. Pro and up. Upload a certificate you bought from another authority. It replaces the free one on that site, and you renew it yourself.
- Force HTTPS. Included. Send every plain HTTP request to the same address over HTTPS with a 301 redirect.
Speed
- HTTP/3. Included. A browser that supports it connects over QUIC on UDP port 443. Other browsers use HTTP/2 or HTTP/1.1.
- Caching of static files. Included. The edge keeps copies of images, fonts, audio and video up to 10 MB, and answers later requests for them without asking your server. HTML pages are never cached.
- Cache settings. Pro and up. Turn caching off, set a time that replaces your server’s, or clear the cache so every file comes from your server again.
Origins and control
- One server or several. Included. Send visitors to a server here or at any public address. Add more servers, and Edge Proxy spreads requests across them. Each request goes to the server with the fewest requests in progress, and a server that keeps failing is skipped for a short time.
- Redirect rules. Included. Send matching paths to another address, or redirect a whole domain without asking your server. Redirect requests with rules
- Your own error page. Included. Change the words, colours and links of the page visitors see when your server does not answer.
- WebSockets and PROXY protocol. Included. Pass WebSocket connections through, and send your server a PROXY protocol version 2 header with the visitor’s address.
The path a request takes
The edge handles each request in this order, and the first step that answers ends it.
- The visitor connects. Over HTTP/3, HTTP/2 or HTTP/1.1, with TLS 1.3 or TLS 1.2 and the certificate for the name.
- Redirects answer first. A whole-domain redirect, Force HTTPS or a matching redirect rule answers the request, and your server is not asked.
- Your rules run. Your firewall rules block, challenge or rate-limit the requests they match, before the cache.
- The cache answers. A copy of a static file answers the request without asking your server.
- The managed rules check. They score the path, query string, method, headers and the first 64 KB of the body, without uploaded files.
- Your server answers. The edge forwards the request to an origin and passes its answer back. A body over the web proxy’s limit gets 413.
What customers build with Edge Proxy
A WordPress site with HTTPS and a firewall
Run WordPress on a server of yours and put its domain behind Edge Proxy. Visitors get HTTPS, and the managed rules check every request to the login page.
Uses: A server, a domain in our DNS and Edge Proxy
A site that stays with its current host
Point a web proxy at the address of your current host. The site keeps running there, and visitors reach it through our network with a free certificate.
Uses: Edge Proxy and hosting you already have
An API with a request limit
Add a rate limiting rule on the path of your API, such as 100 requests a minute from each visitor. A client past the limit gets 429 with a Retry-After header.
Uses: Edge Proxy on the Business plan
Limit how many requests a visitor sends
Two servers behind one name
Add a second server as another origin. Edge Proxy spreads requests between the two and skips one that keeps failing.
Uses: Two servers and Edge Proxy
Limits
The fixed limits of a web proxy, whatever your plan.
| Requests | |
|---|---|
| Request body | 1–100 MB, 100 MB by default |
| Origin timeout | 1–120 seconds, 60 by default |
| Web proxies for one name | One web proxy for each name, across all accounts |
| Rules | |
| Rules on one web proxy | 200, 50 of them rate limits, within what your plan allows |
| Values in one condition | Up to 50, each up to 200 characters |
| What a rule cannot match | A header other than the user agent, referrer and cookie |
| Managed rules | You cannot change them or exempt a path from them |
| Cache | |
| Largest file cached | 10 MB |
| HTML pages | Never cached |
Add-ons
An add-on raises one limit without a change of plan.
- Websites Pack: 10 more websites for your account, without a change of plan.
Guides for Edge Proxy
Our docs explain each setting, step by step.
- How web proxies work: How a web proxy serves your site, and how its server, certificate, firewall and redirects fit together.
- Create a web proxy: Serve an address through our network, in front of one of your servers or an address of your own.
- Protect a website with the WAF: Turn the firewall on or off for each site, and add rules that block, challenge or rate-limit requests.
- How SSL/TLS certificates work: How we issue and renew free certificates, and serve the ones you upload.
- Redirect requests with rules: Send visitors from one path or address to another.
- Customise the error page: Change the page visitors see when your server does not answer, with your own words, colours and links.
Put your site behind Edge Proxy
Start on the Free plan with 3 websites, free certificates and the managed firewall.
Frequently asked questions
Does Edge Proxy cost extra?
Edge Proxy comes with every plan, and a web proxy needs no order and no invoice. Your plan sets how many websites you can have, and a web proxy for an address outside the domains in our DNS counts as one.
Can my site stay with its current host?
Edge Proxy can send visitors to any public address, so your site can stay where it is. You can also add more servers, and it spreads requests across them.
Does the edge cache my pages?
The edge caches images, fonts, audio and video, and never your pages, so visitors always get the current page from your server. On Pro and above you can change the cache settings and clear the cache.
What does the firewall block?
The managed rules block common attacks, such as SQL injection and cross-site scripting, and known scanners. A suspicious request gets a check that asks the visitor to confirm they are human. Under attack mode asks every visitor a math question while a flood of requests lasts, and hotlink protection stops other sites from showing your pictures. From Pro, you can add custom firewall rules.
Can I use my own certificate?
From Pro, you can upload a certificate you bought from another authority, and it replaces the free one on that site. We do not renew an uploaded certificate, so upload the new one before the old one expires.
Which TLS versions and HTTP protocols does the edge accept?
The edge accepts TLS 1.3 and TLS 1.2, and refuses SSL 3.0, TLS 1.0 and TLS 1.1. Browsers connect over HTTP/3, HTTP/2 or HTTP/1.1. The edge talks to your server over HTTP/1.1 or HTTP/2, with or without TLS.
Can a firewall rule block an IP address?
Yes, from Pro. A rule can match one address or a range of addresses, IPv4 or IPv6, and it can block the request or ask the visitor the math question. Rules also match the path, query string, method, user agent, referrer, cookie or country of a request. A rate limiting rule counts the requests from each visitor’s address, and answers 429 to one that sends too many.
What does my server see of each visitor?
Your server gets the visitor’s method, path and headers, with X-Forwarded-For and X-Real-IP set to the visitor’s IP address and X-Forwarded-Proto set to https or http. With PROXY protocol on, each connection also starts with a version 2 header that carries the address.
