Three layers, each stopping a different problem
A site that faces the internet suffers three kinds of trouble at once: volume that fills the link, requests built to abuse the application, and slowness for visitors who sit far from your server. A CDN, DDoS filtering and a web application firewall answer one each, and they work best when they are planned together instead of being bought as unrelated extras. This page explains how we combine them for teams hosting in Frankfurt: what belongs to the network, what our engineers configure for you, and what you should decide before an attack forces the decision. The examples are typical for Romanian online shops, fintech APIs and logistics portals.
CDN: keep static files close to the visitor
A CDN stores copies of your static files (stylesheets, scripts, images, fonts) on servers near the visitor, so most requests never reach your origin. For a company in Bucharest selling to customers in Germany or the Netherlands, that is the difference between a page that waits for a round trip and one that is answered next door. The side effect matters just as much: when the edge serves the bulk of the requests, a spike or a flood has to get past the cache before it can touch your server. We integrate Cloudflare in front of your origin, or bunny.net where it suits the project better.
Edge cache for static files
CSS, JavaScript, images and fonts are kept at the edge. Lifetimes follow the Cache-Control headers your application already sends, so you decide what is cached and for how long.
Compression and lighter images
Brotli compression and conversion of images to WebP can be switched on at the edge, so pages get lighter without a single change to your code.
HTTPS and HTTP/3
Certificates are issued and renewed automatically, and HTTP/3 (QUIC) is available at the edge, which visitors on mobile networks notice most.
A closed origin
On request we close the origin to everything except the CDN. An attacker who discovers your server address then cannot walk around the edge and hit the application directly.
DDoS protection: volume is stopped in the network
A volumetric attack is decided before your server sees a single packet, so the first line of defence has to sit in the network. L3/L4 DDoS filtering is part of our network in front of the servers in Frankfurt, rated at 1.5 Tbps, and it is included for VPS and dedicated servers: you do not order it. Attacks that imitate ordinary web traffic are another matter. They need rules that understand your application, which is the job of the WAF layer further down. Legitimate peaks, such as a Black Friday campaign or a ticket sale, look alike at first, so we separate them with limits per route and never with a blanket block.
Network and transport
Packet filtering at IP, TCP and UDP level absorbs SYN, UDP and ICMP floods and amplification attacks before they reach your server. It is part of the network and needs no action from you.
Application layer
HTTP floods, slow connections that hold sockets open and floods aimed at expensive endpoints such as search, login and checkout are handled with rate limits per IP, region or path. The limits belong to the WAF service and are tuned to your routes from your included hours.
Bot filtering
Crawlers, scrapers and credential-stuffing tools are told apart from real visitors by their behaviour. Search engine crawlers stay on an allowlist, so your rankings are not collateral damage.
WAF: read the request before the application does
A web application firewall inspects every HTTP request and drops the ones that look like injection, code execution or abuse of a form. The rules follow the OWASP Top 10 and are kept up to date. It is a CyberSecurity service delivered by our engineers, not a switch that is on by default. We start in monitoring mode, learn what your real traffic looks like, exclude what is legitimate and only then turn blocking on. You request the work from the client panel and it is drawn from the hours included in your plan. WordPress sites get dedicated rules against brute force on wp-login.php, and custom rules can be added when your application has behaviour a standard ruleset does not know.
- SQL injection (SQLi) in forms, search boxes and API parameters
- Cross-site scripting (XSS) in comments, profiles and rich-text fields
- Cross-site request forgery (CSRF) on requests that change state
- Remote code execution (RCE) and unsafe deserialisation attempts
- Local file inclusion (LFI) and path traversal
- Brute force on logins, including wp-login.php on WordPress
- Traffic shaping for scrapers and credential stuffing
- Geographic rules per route, for example an admin path open only to your own countries
From switching on the CDN to a tuned WAF
The CDN integration is quick. The WAF takes longer on purpose, because it learns from your real traffic before it starts blocking. Our team performs most steps; yours are the decisions that only the owner of the site can take.
Switch Cloudflare on in the panel
In the client panel, open Domains, choose the domain and enable Cloudflare. The zone is created in your own Cloudflare account, or through ours if you would rather not manage one.
Point the nameservers
Cloudflare asks for a nameserver change at your registrar, and we show you the exact values. If only some subdomains should use the CDN, a partial CNAME setup is the alternative. Propagation can take up to a day.
Review the cache rules
The defaults are conservative: static files are cached and dynamic pages bypass the cache. Carts, customer accounts and any page whose content changes per user must never be cached, so we check those paths with you.
Request the WAF
Open a request in the DevOps Services section of the panel and name your domains, your sensitive integrations and the window in which we may change rules. We run in monitoring mode first, then enable blocking and rate limits route by route.
Watch it for a week
The first week shows traffic, blocked requests and the cache hit rate. If a real customer is blocked, we adjust the rule that matched instead of lowering the protection of the whole site.
TLS certificates: automatic by default, stricter on request
Browsers warn on anything that is not HTTPS, so every site needs a certificate. Let's Encrypt certificates are issued and renewed automatically on your domains, which covers most company sites and shops. Some buyers, in banking, fintech and public tenders, ask for more, and the platform supports that too.
Let's Encrypt (DV)
Domain-validated certificates, issued and renewed without manual work. A good fit for company sites, shops and most APIs.
OV and EV certificates
Organisation or extended validation, bought by you from a certificate authority and installed by us. Browsers no longer show the company name in the address bar, so these matter mainly when a bank, a tender or a partner contract demands them.
Wildcard certificates
One certificate for every subdomain of your domain. Useful for agencies and SaaS products that give each customer an address of their own.
Mutual TLS (mTLS)
Client and server verify each other's certificates. It suits B2B and partner APIs, for example the link between a fintech and its banking partner, and we configure it together with you.
Logs, alerts and visibility
When traffic turns strange you need evidence, not guesses. Monitoring is built with Prometheus, Grafana and Loki as part of the DevOps service, and the CDN and WAF data join the same picture.
Centralised logs
Loki and Promtail collect logs from nginx, applications and the firewall, and you query them in Grafana. Retention is agreed with you, so it matches what your audits require.
Security analytics
The Cloudflare dashboard lists blocked requests, attack sources and the most targeted paths. Logs can be exported to your own SIEM, or to a SIEM that we run for you.
Real-user performance
Core Web Vitals measured on real visitors point to the pages and files that slow the site down, so optimisation starts from data.
Availability checks
External checks watch the site from outside our network and alert you by e-mail or SMS. An optional public status page can keep your own customers informed.
Questions about CDN, DDoS and WAF
Do I have to move my nameservers to Cloudflare?
For a full setup, yes: Cloudflare must answer DNS for the domain so that traffic flows through its network. If only some subdomains should use the CDN, a partial CNAME setup works instead. We help you choose, and the domain stays registered where it is today.
Is the WAF included in my plan?
L3/L4 DDoS filtering is part of the network. The WAF is a CyberSecurity service that our engineers configure and maintain, paid from the monthly hours of your plan: 1 h a month on cPanel from Advanced up, 1–8 h on VPS, 5–10 h on dedicated servers depending on the plan, and 10 h on GPU servers. You request the work from the client panel. Hours do not carry over, and extra hours are accepted and billed separately. Plan details are on the pricing page.
What happens if the WAF blocks a real customer?
Send us the time and the address. We find the request in the WAF log and adjust the rule that matched. Allowlisting an IP or a region is possible, but narrowing the rule is usually better, because it keeps protecting the other users of the same route.
Can I use my own certificate from a commercial authority?
Yes. You upload the certificate and the private key in the client panel and we install them on nginx or Apache. With Cloudflare in front, a certificate on the origin still protects the last hop between the edge and your server.
Will a WAF make my site slower?
An edge WAF inspects requests in the same place as the cache, so the cost is small. A ModSecurity layer on your own server does add work to each request, and we measure it on your application while tuning. If one route is too sensitive to delay, we can exempt it and protect it another way.
Can you stop scraping?
Rate limits, behaviour checks and challenges on suspicious requests stop most scrapers, and they are part of the WAF work. Cloudflare also sells advanced bot management, billed by Cloudflare on its own plan; it is worth considering only if scraping is a real commercial problem for you.
Put the edge in front of your origin
Enable Cloudflare for a domain from the client panel, then ask our engineers for the WAF in the DevOps Services section. Support is available in English and Romanian.
See VPS plans →