# Web protection (L7 & WAF)

> Stop HTTP floods, credential stuffing and OWASP Top 10 attacks with a reverse-proxy in front of your site.

Source: https://docs.avenlith.com/en/web-protection  
Category: DDoS protection  
Last updated: 2026-09-22

## Enable web protection

```bash
avenlith shield web create --domain shop.example.com --origin 203.0.113.24
avenlith shield web rule add shop.example.com --path "/login" --rate 20/min --action challenge
avenlith shield web rule add shop.example.com --country RU,TR,DE --action allow
avenlith shield web mode shop.example.com --under-attack on
```

Point your domain's DNS to the address shown in the console. Avenlith terminates TLS, inspects each request and forwards clean traffic to your origin.

## Rules

- **Rate limits** per path, IP, country or header
- **Challenges** — invisible JavaScript proof-of-work instead of CAPTCHAs
- **Managed WAF rules** for SQL injection, XSS, path traversal and known CVEs
- **Bot scores** from 1 to 99 to separate humans, good bots and scrapers

## Under-attack mode

During a large HTTP flood, under-attack mode challenges every new visitor for 5 seconds. Returning visitors with a valid cookie are not affected.

> **Warning:** > Lock your origin firewall to Avenlith proxy ranges only. Attackers who know the origin IP can bypass web protection.