HEIMWALL is an edge security platform that protects you from attacks, accelerates your traffic and keeps it fully visible. It combines WAF, CDN, DDoS protection and managed DNS in a single console — so you no longer juggle three separate providers.
All traffic passes through the HEIMWALL network before it reaches your origin server. Malicious requests stop at the edge; legitimate visitors get instant responses from the nearest point, straight from cache. Your origin IP is never exposed.
When a visitor sends a request, traffic reaches HEIMWALL Edge first. The request is evaluated against WAF rules, a 0–100 bot score and continuously updated threat intelligence. Attacks are stopped here; clean traffic is served from cache or forwarded to your origin.
And you don’t need to write a single rule: as soon as routing is verified, HEIMWALL starts protecting you automatically with its own managed rule set. If you like, you can review and customize these rules on the Managed Rules → page.
Visitor ──► HEIMWALL Edge ──► Origin Server (WAF · Bot · Cache · SSL)Security, performance and observability are managed from a single control plane. No extra modules, no extra cost. Every change you make in the console — a rule, a certificate, a cache setting — propagates to all edge servers within seconds.
Complete protection against attacks
Write your own rules across 30 fields, 14 operators and 20+ actions with the visual rule builder. Or enable HEIMWALL’s managed rule set, a threat-intelligence deny list and the OWASP Top 10 scan (SQL injection, XSS, RCE, SSRF, path traversal) with one click.
Intelligence that tells bots and AI crawlers apart
A real-time 0–100 bot score and 17 bot categories on every request. It identifies AI crawlers like GPTBot and ClaudeBot by name, detects VPN, Proxy, Tor and Apple Private Relay, and classifies IPs as residential/mobile/hosting and more. Cut malicious automation without blocking legitimate bots like search engines.
Speed at the edge
HTTP/3 + QUIC, edge CDN, Brotli compression, Auto-Minify and image optimization serve pages from the nearest PoP. Automatic ECDSA + RSA dual certificates (Let’s Encrypt & ZeroSSL) are set-and-forget and renewed before expiry. On supporting clients, TLS 1.3 connections are protected with a post-quantum key exchange.
Resilience against L7 DDoS
Multi-layered application defense: RPS-based automatic challenge (with a circuit breaker), per-IP rate limiting, behavioral failban and a FIFO waiting room during sudden traffic spikes. Your origin stays up under pressure.
Managed DNS & failover
Manage all your DNS records from one panel. Geo-routing sends visitors to the nearest region; origin health checks and automatic failover hide outages. DNSSEC is handled automatically.
Full visibility
Live access logs and log forwarding to your SIEM (TCP/TLS), cookieless analytics, a consent-gated persistent visitor ID (IAB TCF), audit log and health monitoring. Stream events (challenge, failban, rule) to your own systems via webhooks.
PoPs in Türkiye and a KVKK/GDPR-compliant architecture. In the Hosted model, traffic inspection runs entirely on your own servers — your data never leaves your environment. Certificates and keys are encrypted at rest with AES-256-GCM, and every management action is recorded in an audit trail.
WAF, CDN, DDoS and managed DNS in a single interface, on a single bill. Every change you make propagates to the whole edge network within seconds.
Sell HEIMWALL to your customers under your own brand: the panel domain, logo and colors are yours, and you use your own SMTP and DNS account. Your customers see only your brand while HEIMWALL runs the infrastructure in the background.
You can use HEIMWALL in three ways depending on your needs:
HEIMWALL Cloud
Runs fully in the cloud. Just point your DNS; no installation needed.
HEIMWALL Reseller
The reseller product that lets you manage and bill your own customers under your own brand.
HEIMWALL Hosted
The WAF software runs on your own servers; management is done from HEIMWALL Cloud.
Setup takes a few minutes: point your existing A/AAAA record to the HEIMWALL addresses, and once routing is verified, managed rules, bot protection and SSL activate automatically. If you prefer, you can also move your DNS to HEIMWALL Managed DNS.