Offline during peak hours
Anyone can rent a DDoS attack by the hour for pocket change. Twenty minutes of downtime during a product launch or promotion costs far more than preventing it.
The real cost of an attack
Downtime and bad bots cost more than bandwidth.
Exploits in your application
Automated scanners probe every site for SQL injection, exposed admin panels, and outdated plugins around the clock. One unpatched vulnerability is enough to leak customer data or give attackers control of your site.
Captchas that drive buyers away
Generic security tools challenge everyone whenever traffic looks unusual. Every puzzle placed in front of a buyer lowers your conversion rate.
How edge filtering works Fast for customers.
Fast for customers.
Closed to attackers.
Same domain, same URL. Every request is inspected at the edge in milliseconds before it reaches your server. Legitimate visitors go straight through. Floods, scanners, and bad bots are stopped at the perimeter. Drag the slider to compare both views.
LunariaNew in · Women · Men · Cart (2)
AUTUMN COLLECTION
Heavyweight linen shirts and trousers.
Free shipping over €80. Delivered in 2 days.
Shop collection
What your customer seesYour site, served fast with nothing in the way.
What an attacker getsRequests dropped, rate-limited, or blocked at the edge.
Services Pick one service
Pick one service
or hand us all of it.
Everything runs on our own infrastructure and is managed by engineers who know your setup.
DDoS mitigation
We absorb network and application floods on hardware reserved for your traffic, with filtering rules built for your specific setup.
41 Gbpspeak flood dropped at edge
Bot management + API security Bot filtering and API protection
Search engines, payment webhooks, and uptime monitors pass straight through. Scrapers, scalpers, credential stuffers, and fake signups are blocked. For APIs, we enforce schema validation and per-key rate limits.
Managed WAF and vulnerability scanning
We scan your stack on a schedule, deliver clear remediation reports, and block exposures at the edge while your team patches the code. Newly disclosed CVEs receive same-day virtual patches.
# CVE-2026-4471 · unauthorized file upload
POST /wp-content/uploads/shell.php
→ blocked at the edge · origin untouched
POST /wp-content/uploads/shell.php
→ blocked at the edge · origin untouched
CDN and speed optimization
We serve your site from our edge and tune your caching, images, and database queries. If your current host is the bottleneck, we will recommend the right provider and handle the migration.
HTTP/3enabled by default
AVIFautomatic image optimization
Full-stack security and edge infrastructure
Select any service to see what is included.
Stop the attacks5
Hide and harden4
Make it fast3
Private networking2
Layer 4 DDoS protection
We scrub SYN, UDP, ACK, and amplification floods on hardware dedicated to your network. Filtering rules match your exact ports and protocols so legitimate traffic stays responsive during volumetric attacks.
- Always-on inline scrubbing with zero routing delay
- Custom filters tailored to your ports and protocols
- Capacity sized for your traffic
Get a free scan →Available standalone or as part of a full plan.
Layer 7 DDoS protection
We stop HTTP floods, slowloris attacks, and cache-bypass spikes before they reach your origin. Rate limits and behavioral rules are tuned around how visitors actually use your checkout, login, and search pages.
- Zero captchas or waiting rooms for real visitors
- Route-specific thresholds for checkout, login, and search
- Live rule tuning by engineers during active attacks
Get a free scan →Available standalone or as part of a full plan.
Managed WAF
Our engineers write, test, and maintain your Web Application Firewall rules. We cover the OWASP Top 10 from day one and deploy virtual patches at the edge as soon as new vulnerabilities go public.
- Complete OWASP Top 10 protection
- Same-day virtual patching for new CVEs
- Hand-tuned rules to prevent false positives
Get a free scan →Available standalone or as part of a full plan.
Bot management
We separate legitimate automation from abuse using TLS fingerprints, request timing, and behavioral signals. Search crawlers and payment providers pass through; scrapers, scalpers, and credential stuffers are blocked.
- Verified search engines and webhooks allowed automatically
- Protection against scraping and automated abuse
- Detailed logs showing every block and allow decision
Get a free scan →Available standalone or as part of a full plan.
API security
We validate requests against your API schema, enforce granular rate limits per token or IP, and catch abnormal traffic patterns before they expose data or overload your backend.
- Request validation against your OpenAPI schema
- Per-key, per-user, and per-IP rate limiting
- Real-time alerts for leaked keys and anomalous usage
Get a free scan →Available standalone or as part of a full plan.
Backend invisibility
We place a dedicated reverse proxy in front of your origin server and lock down your firewall so it only accepts connections from our network. Attackers cannot bypass your edge protection when your real IP is unroutable.
- Reverse proxy masking your origin IP
- Origin firewall locked exclusively to our edge nodes
- Historical DNS and mail header IP leaks identified and closed
Get a free scan →Available standalone or as part of a full plan.
Server hardening
We lock down your servers across open ports, SSH access, user permissions, kernel parameters, and service configurations. You receive a complete changelog documenting every adjustment.
- Key-only SSH authentication with root login disabled
- Unused services and public ports closed
- Automated security patching and full audit documentation
Get a free scan →Available standalone or as part of a full plan.
Vulnerability scanning and reporting
We scan your applications, APIs, and servers on a set schedule and deliver clear reports prioritized by real-world risk. Critical exposures are mitigated at the edge immediately while your team prepares a permanent fix.
- Scheduled scans across web apps, APIs, and host servers
- Clear remediation steps ranked by exploitability
- Immediate edge virtual patching for critical findings
Get a free scan →Available standalone or as part of a full plan.
Email security
We configure and monitor SPF, DKIM, and DMARC so attackers cannot spoof your domain and your legitimate emails stay out of spam folders.
- Full SPF, DKIM, and DMARC enforcement (p=reject)
- Continuous DMARC report monitoring and spoofing alerts
- Outbound mail header cleanup to prevent origin IP leaks
Get a free scan →Available standalone or as part of a full plan.
CDN
Your pages, images, and static files are served from edge servers close to your visitors. Because caching and DDoS filtering run on the same edge nodes, security adds no extra latency.
- Cache nodes with guaranteed throughput
- HTTP/3, Brotli compression, and automatic image conversion
- Custom caching rules tailored to your application
Get a free scan →Available standalone or as part of a full plan.
Website performance optimization
Our engineers audit your frontend and backend to resolve actual bottlenecks across caching, asset delivery, third-party scripts, fonts, and database queries.
- Technical performance audit by senior engineers
- Hands-on implementation alongside your team
- Verified before-and-after Core Web Vitals benchmarks
Get a free scan →Available standalone or as part of a full plan.
Hosting recommendation
If you are outgrowing your current host, we evaluate your traffic patterns, stack, and budget to recommend reliable bare-metal or cloud providers, and handle the migration when you are ready.
- Unbiased provider comparisons based on your workload
- Clear cost, hardware, and network trade-offs
- Full migration support with zero downtime
Get a free scan →Available standalone or as part of a full plan.
VPN creation
We build and manage private VPNs for your team and servers, removing admin panels, staging sites, and databases from the public internet.
- Admin panels, SSH, and databases restricted to private tunnels
- Per-user credentials with one-click revocation
- Configured across your servers and employee devices
Get a free scan →Available standalone or as part of a full plan.
Proxy creation
We deploy and monitor dedicated proxies with clean, static IPs for partner allow-listing, regional testing, and secure outbound routing.
- Fixed IP addresses in your chosen locations
- Strict authentication and access controls
- Continuous uptime and IP reputation monitoring
Get a free scan →Available standalone or as part of a full plan.
Why bastardad
How we compare to shared cloud platforms.
Shared cloud providers run millions of domains on the same machines under one generic ruleset. That works until your traffic spikes or an attacker targets your application logic.
| Typical shared protection |  bastardad | |
|---|---|---|
| Hardware | Shared across thousands of domains | Dedicated to your traffic |
| Rules | Generic ruleset for every customer | Custom rules for your application |
| Uncertain traffic | Disrupts visitors with captchas | Filtered silently at the edge |
| Origin server IP | Often exposed via DNS or mail leaks | Masked behind a reverse proxy |
| Support | Ticket queue and automated replies | Direct access to engineers who know your stack |
| Onboarding | Self-service dashboard | Configured and tuned with you |
Protection tailored to your architecture.
What targets your site
- DDoS floods at the network and application layer
- Exploit attempts against your application and plugins
- Bad bots and abuse of your logins and APIs
- Direct attacks on your origin server IP
- Unpatched software and exposed ports
- Spoofed emails sent from your domain
What we deploy for you
- Layer 4 and Layer 7 DDoS mitigation
- A managed WAF with rules written for your stack
- Bot management and API security that let real users through
- A dedicated reverse proxy that keeps your origin hidden
- Vulnerability scanning, reporting, and server hardening
- Email security that protects your domain
Dedicated hardware Isolated hardware
Isolated hardware
for your domain.
On shared security platforms, a major attack against another customer on the same node can increase your latency. With bastardad, your filtering and caching run on dedicated resources sized for your traffic, so another site's attack never slows yours down.
- Reserved CPU and bandwidthCapacity sized for your domain, even during peak attacks.
- Inline L4 and L7 filteringMalicious packets and requests are dropped before reaching your origin.
- Origin IP maskingA reverse proxy keeps your backend IP completely unroutable.
- Integrated edge cachingThe same hardware that filters attacks serves your cached assets at low latency.
How it works From first scan
From first scan
to live protection in days.
Step 1
Free external scan
Send us your domain. We check what is visible from the outside, including open ports, leaked origin IPs, DNS issues, and outdated software, then send you a clear report at no cost.
scan your-domain.com → 7 exposures identifiedStep 2
Custom edge setup
We set up your edge, place your origin behind a reverse proxy, and write WAF and rate-limiting rules tailored to your site. You review the setup directly with your assigned engineer.
profile: custom · WAF & rate-limit rules activeStep 3
DNS cutover
Update two DNS records and your traffic flows through our edge within minutes. We monitor your stack continuously and send concise weekly activity reports.
412,907 hostile requests blocked · 0 captchas served 24/7 active
monitoring.
We watch your traffic around the clock and adjust rules as attack patterns change, so your team can stay focused on your business.
Questions
Frequently asked questions
Will my customers ever see a captcha or waiting room?
No. We evaluate requests at the edge using TLS fingerprints, protocol behavior, and request patterns. Suspicious automation is rate-limited or dropped silently without putting puzzles in front of human visitors.
Do I need to change my hosting provider?
No. You keep your existing server and hosting provider while we sit in front as your edge network and reverse proxy. If your current host is causing performance issues, we can recommend alternatives and assist with migration.
What happens if a legitimate visitor is blocked?
Every block is logged in real time, and our engineers can adjust rules or allow-list traffic within minutes. Because we tune your ruleset to your application before going live, false positives are rare.
We are under attack right now. How fast can you onboard us?
Contact us and mark your request as urgent. We can provision your edge proxy and route traffic as quickly as DNS propagation allows, then fine-tune filtering rules live while mitigating the attack.
Is this only for large enterprises?
No. Smaller sites are targeted frequently because attackers assume they lack proper defenses. We size hardware and pricing to your actual traffic volume.
Can we purchase a single service instead of a full bundle?
Yes. You can start with a single service, such as Layer 7 DDoS protection, Managed WAF, or server hardening, and add more as your requirements grow.
Free security scan See what an attacker can find on your domain.
Enter your domain below. We will run a non-intrusive external scan and send you a plain-English report covering exposed ports, origin IP leaks, and priority fixes. Free, with no credit card or sales script.
No captcha here. Our dog sniffs out bots by itself.
We only use your email to reply to this request.
Under attack right now? Contact emergency response.