Product · How it works
Monitor, review, block, roll back.
Most WAFs ask you to trust that they won't break your site. DBshieldX shows you. Every route starts in monitor mode, you review what it would have blocked, you switch routes to blocking one at a time, and any change can be undone in seconds.
Where it sits
Two checkpoints: one for every request, one for every query.
DBshieldX adds a small proxy behind the nginx you already run. Nothing changes in your app. If DBshieldX is ever slow or down, traffic goes straight through to your app.
- 1
Visitor
People, bots and scanners
- 2
Your nginx or CDN
TLS and caching, as today
- 3 · DBshieldX proxy
Request check
9 attack classes, bots and behaviour, scored in about 3 ms. Repeat attackers banned through CrowdSec.
- 4
Your app
Unchanged
- 5 · DBshieldX SQL check
Query check
Learns your app's query shapes and flags any it has never seen.
The rollout
01 · Monitor
See what it would block
Every route starts in monitor mode. DBshieldX logs what it would have stopped and never touches real visitors.
02 · Review
Decide in one click
Mark each group of findings as an attack or expected traffic. Expected traffic becomes a precise exclusion for that rule, field and route.
03 · Block
Switch on with evidence
A route can block once it has run 7 days with its queue settled. You get an alert on its first block, and any block later marked expected counts as a false positive.
04 · Roll back
Every change is a version
Activate any earlier policy version and every proxy picks it up in under 7 seconds, with no restart.
Route by route
Each route moves at its own pace.
A login form, a checkout and a payment provider's webhook carry very different traffic. DBshieldX treats each route on its own, so you can block the noisy login page this week and leave the partner webhook in monitor mode for as long as you like.
- check_circleA route is ready to block after 7 days in monitor mode with its review queue settled.
- check_circleExpected traffic becomes an exclusion for that rule, field and route only.
- check_circleYou're alerted on a route's first block; any block later marked expected counts as a false positive.
- check_circleRoutes can be pinned to monitor mode permanently.
Day to day
Fleet-wide bans
Clients that keep sending high-risk requests are banned through CrowdSec for 4 hours, then 24 hours, then 7 days, and the ban applies on every server you run.
Alerts where you work
Alerts go to the dashboard and to a webhook, so they can reach your chat or an automation tool such as n8n.
A dashboard you can sign in to safely
Country map, top networks, engine health and a PDF research report, behind two-factor single sign-on.
Changes without restarts
Policy changes and rollbacks reach every proxy in under 7 seconds, with no restart.
Small and fast
The proxy added 3.2 ms at p95 on our live traffic in October 2026. It fails open if the engine is slow or stopped.
Two layers
The request check covers the common attack classes, bots and behaviour. The query check watches what reaches your database.
FAQ
See it on your own traffic.
We'll set up DBshieldX in monitor mode on one of your sites and walk you through what it finds after a week. Nothing is blocked until you say so.