Website protection that keeps public services online
Guardian sits in front of your website. You point your domain at Guardian, and every request is checked before it reaches your server. Attacks, automated abuse and floods are refused at the edge, and real visitors reach your site as usual. Your team sees every decision in one console.
How it works
Onboarding a website is a DNS change. Once your organisation is verified, you add the domain in the console, update one record with your DNS provider and Guardian starts serving the site. Your server and your content stay where they are. Guardian keeps no copy of your pages or your users' data.
If you ever want to leave, you point the DNS record back at your own server. Nothing else needs to change.
What Guardian stops
- Common web attacks. Managed rules refuse requests that carry injection, cross-site scripting, path traversal and similar patterns before they reach your application. Each refusal is recorded with the reason.
- Floods and abuse. Rate limits cap how fast one source can call a page, a login form or an API. You can set limits per path, so a results page or an OTP endpoint gets the strictness it needs.
- Bots. Guardian tells real visitors apart from automated tooling. When a visitor looks automated, a brief human check runs before the page opens. It completes on its own for real people, and scrapers and credential stuffing tools are stopped.
- Unwanted networks. You can block or challenge traffic from specific networks and countries when an attack is coming from a known source.
Certificates and connection security
Every protected site gets its certificate automatically and renewed before it expires. If your institution must use its own certificate, you can upload it instead. For internal portals and partner systems, Guardian can require a client certificate, so only devices you have issued a certificate to can connect at all.
Connections are protected by Guardian Protocol, which includes post-quantum encryption with browsers that support it. Data recorded today stays protected against future decryption attempts.
What your team sees
- A live world map and per-site counters of blocked traffic, with a running record of what was stopped and why.
- Email alerts for events that need a person, such as an attack in progress or a certificate problem.
- Under-attack mode, switched on with one click, which raises protection on a site during an incident.
- A monthly report per site with blocked requests, attack types and what changed, for your management and auditors.
- Team roles, so viewers, operators and administrators get the access they need, and an audit log of every change made in the console.
- An optional trust badge you can place on your site to show visitors it is protected by Guardian.
Check your site first
The free security check grades any public website from A to F in a few seconds, using only normal requests. It is a good way to see where a site stands before you request protection.
Who it is for
Website protection is built for organisations whose websites are part of a public service: hospitals with patient portals, universities with admissions and results pages, government departments with citizen services, and banks with customer portals. These sites tend to share three problems. They are probed by automated tools every day, they face sudden spikes on the days that matter, and they are often maintained by a small team or an outside vendor who cannot watch them around the clock.
Guardian takes the routine work off that team. Attacks are refused automatically, and people are only alerted when something needs a decision.
Rules you control
Guardian ships with managed rules that are kept up to date, so most sites need no tuning. When you do need something specific, the console lets you adjust protection for a site: allow a trusted partner network, challenge traffic from a network that is causing trouble, or tighten a rate limit on a form that is being abused. Every change is written to the audit log with who made it and when, so there is always a record to review.
Questions
Do we need to change our website code?
No. Website protection is a DNS change. Your application, hosting and content stay the same.
Will the site slow down?
Real visitors should not notice a change. Guardian is built to keep sites fast while they are protected.
Can we protect an API or a portal used only by partners?
Yes. Rate limits work per path, and you can require client certificates so only devices you have issued certificates to can connect.
Does Guardian make our site impossible to attack?
No security product can promise that. Guardian refuses a wide range of attacks before they reach you and shows your team what happened, so you can act on what remains.