Solutions · Self-hosted teams
A WAF that runs on your servers, behind your nginx.
You run your own Linux servers and you'd rather not send every request through someone else's network. DBshieldX runs next to your apps, keeps its data on your machines, and plugs into the tools you already use.
Where it sits
Behind your nginx, not instead of it.
Some self-hosted WAFs want to replace your reverse proxy. DBshieldX adds a small proxy behind the nginx you already run, so TLS, caching and your existing config stay where they are. If DBshieldX is ever slow or down, traffic goes straight through to your app.
- 1
Visitor
People, bots and scanners
- 2
Your nginx or CDN
TLS and caching, as today
- 3 · DBshieldX proxy
Request check
9 attack classes, bots and behaviour, scored in about 3 ms. Repeat attackers banned through CrowdSec.
- 4
Your app
Unchanged
- 5 · DBshieldX SQL check
Query check
Learns your app's query shapes and flags any it has never seen.
Fits what you run
Docker or systemd
Run it as containers or as services on a Linux host. Install is a change to your nginx upstream; nothing changes in your app.
CrowdSec
Repeat high-risk clients are banned through CrowdSec for 4 hours, then 24 hours, then 7 days, across every server you run.
Your own sign-in
The dashboard sits behind two-factor single sign-on with Authelia.
GeoIP
Country and network views use MaxMind GeoLite2 data, looked up on your own server.
Webhooks and n8n
Alerts go to the dashboard and to a webhook, so you can route them through n8n or anything else.
Multi-tenant API
Tenants, sites and scoped API keys through the management API, if you run sites for more than one team.
Your data, your servers
Self-hosted
The proxy, engine and dashboard run on your own machines. No request is sent to us.
Detail only when you opt in
By default, events record the rule, route and score, not the payload. Turn on evidence excerpts per tenant, with secrets masked and every view logged.
Retention you set
Detail is kept 30 days by default (7 to 90). Client IDs are hashed with a salt per tenant.
Tenants kept apart
Every customer sees only their own sites, keys and data. Dashboard sign-in uses two-factor single sign-on.
Fails open
If the engine is slow or stopped, requests go through and the error is logged. Your site stays up.
Protected by DBshieldX
Our own production sites run behind DBshieldX. Report a vulnerability to security@dbshieldx.com, or read our disclosure policy.
See it on your own traffic.
We'll set up DBshieldX in monitor mode on one of your sites and walk you through what it finds after a week. Nothing is blocked until you say so.