What is the difference between Layer 3/4 and Layer 7 protection?

Layer 3/4 attacks try to exhaust your bandwidth or connection table with raw packets, SYN floods, UDP floods, DNS and NTP amplification. They are loud and comparatively easy to filter at the network edge. Layer 7 attacks look like real traffic: HTTP request floods, credential stuffing, checkout and search abuse, aggressive scraping, API hammering. They arrive over valid TLS from real browsers or convincing imitations, and a network-layer filter cannot see them at all. Every TOSHOST Shield plan includes both, but the Layer 7 stack is where the real engineering sits.

How does onboarding work?

Point your DNS at the TOSCDN edge, or place our transparent reverse proxy in front of your application. Protection is active within minutes. We issue and renew the TLS certificate at the edge automatically, so there is nothing to install and no code to change. Your origin keeps serving exactly as it does today.

Will legitimate visitors or Google get blocked?

No. Verified search engine crawlers are allow-listed and skip both the challenge and the rate limiter, so your rankings are never at risk. Critically, a crawler is only trusted if its IP genuinely belongs to that search engine, a bot merely claiming to be Googlebot falls through to the normal challenge path instead. Human visitors solve the JavaScript challenge invisibly and are cleared for the rest of their session.

How do you tell a real browser from a bot pretending to be one?

Four independent signals, and an attacker has to defeat all of them. We fingerprint the TLS ClientHello (JA3/JA4) to identify the actual client library regardless of the user-agent it claims. We check user-agent against IP ownership for the bots that matter. We measure behaviour with a per-IP sliding window. And we issue a cryptographically signed clearance cookie that only a client which really executed JavaScript can obtain.

Does the WAF slow my site down?

Honest answer: inspection is not free, the OWASP ruleset is roughly 840 rules evaluated per request. What makes it a non-issue is that cacheable responses are served directly from the edge cache and skip inspection entirely, and static assets are excluded from the ruleset by design. For most sites the edge cache more than pays back the inspection cost, and the site ends up measurably faster than it was unprotected.

What happens if my origin server goes down mid-attack?

Always Online takes over. Cached URLs keep serving from the edge, your homepage is served from the last known-good snapshot, and anything else gets a branded notice page with a Retry-After header instead of a raw 502. Visitors and crawlers see a site that is still alive while you fix the origin.

Can I write my own protection rules?

Yes, on Shield Business and above. The Edge Rules engine is declarative, you describe conditions and actions rather than writing code, so a rule cannot crash the edge or leak between tenants. Rules are evaluated after the WAF, which means you can terminate a request early but never accidentally route one around your own protection.

Do I have to move my hosting to TOSHOST?

No. Shield is a protection layer, not a hosting migration. Your application can stay exactly where it is, another provider, your own data centre, or a cloud account, and we protect it from the edge. Customers already hosting with us simply get it switched on.

What counts as a protected hostname?

Each domain or subdomain you put behind the edge, example.com, www.example.com and api.example.com are three. Shield Pro covers 5, Shield Business covers 25, and Shield Enterprise is unlimited. If you need a different shape, talk to us and we will build the plan around it.

Stop DDoS attacks instantly.

Secure your infrastructure with real Layer 7 protection.

Volumetric floods are the easy part. What actually takes sites down is Layer 7, HTTP floods, credential stuffing and API abuse arriving over valid TLS from convincing browsers. TOSHOST Shield inspects every request at the edge with TLS fingerprinting, a layered WAF, bot classification and adaptive challenge, in front of any application, with no code changes.

Explore the Layer 7 stack View pricing

Multi-Tbps capacity Always-on, no rerouting L3 / L4 / L7 in one pass Transparent reverse proxy

Mitigation

Automatic · seconds

Layers

L3 / L4 / L7

Capacity

Multi-Tbps

Mode

Always-on

Edge PoPs

120+

Onboarding

DNS / Proxy

Protection solutions

Three layers, one edge

Every Shield plan covers all three. They are separated here because they fail in completely different ways, and only one of them is solved by raw capacity.

Website & API Protection

Layer 7 defence for anything that speaks HTTP, WordPress, WooCommerce, Laravel, headless APIs. WAF, bot management, challenge and rate limiting in front of your app, with no code changes.

See the Layer 7 stack

Network & DNS Protection

Your origin IP never appears in DNS again. Traffic terminates on the TOSCDN edge, is inspected, then forwarded over a private path your attackers cannot reach directly.

How origin masking works

Infrastructure & Layer 3/4 Defence

Volumetric floods, SYN, UDP, amplification and reflection, are absorbed and filtered at the network edge, long before they can reach an application server or saturate your uplink.

See network capabilities

The Layer 7 stack

Seven checks between an attacker and your application

A Layer 7 attack does not look like an attack. It arrives over a valid TLS session, requests a real URL and returns a 200. Capacity alone will never stop it, you have to inspect it. This is the exact order a request travels through the TOSCDN edge before your origin ever hears about it.

JA3 / JA4 fingerprinting

TLS handshake

Before a single byte of HTTP is read, we fingerprint the TLS ClientHello, cipher list, extensions, curves and their exact order. That identifies the client library, not the user-agent string it claims. A headless attack toolkit cannot hide behind a copied Chrome header.

Spoofed user-agents · headless toolkits · botnet TLS stacks

Bot classification

Access phase

Every request is scored into allow, block or pass. Verified search engines are allow-listed, but only if the IP genuinely belongs to Google, Bing or the rest, never on the user-agent alone. Known scanners, exploit kits and aggressive scrapers are blocked outright.

Vulnerability scanners · scrapers · fake Googlebot

ModSecurity + OWASP CRS

Rewrite phase

The full OWASP Core Rule Set, roughly 840 rules, runs in front of your application, with per-domain exclusions so a false positive on one site never weakens the ruleset for everyone else.

Injection · protocol abuse · known CVE payloads

TOSCDN signature WAF

Access phase

A second, deliberately narrow ruleset built for zero false positives: JIT-compiled PCRE signatures for SQL injection, XSS, path traversal, remote code execution and probes for sensitive files. Every rule is auditable, no opaque bytecode.

SQLi · XSS · traversal · RCE · config-file probes

Edge Rules engine

Rewrite phase

Your own declarative when / then policy, evaluated at the edge, block a country from checkout, rate-limit one API path, challenge a header pattern. Rules run after the WAF by design, so a rule can terminate a request but can never smuggle one past your protection.

Business-logic abuse · targeted campaigns · API misuse

Adaptive rate limiting

Access phase

A sliding-window counter per source IP. Cross the soft limit and you get a challenge; cross the hard limit and you are temporarily blocked, with the block escalating each time the same source comes back.

HTTP floods · credential stuffing · brute force · scraping

Global Protect challenge

Under attack

When an attack is detected the edge arms a JS challenge for every uncleared visitor, disarming itself automatically once the flood passes. Real browsers solve it invisibly and receive an HMAC-signed clearance cookie. Flood bots never do.

Layer 7 floods · botnets · request-per-second spikes

Your origin, and Always Online if it falls over

Only clean traffic reaches your server. If the origin goes down anyway, mid-attack or mid-deploy, cached URLs keep serving, your homepage is served from the last known-good snapshot, and everything else returns a branded notice instead of a raw 502. Your site keeps looking alive while you fix it.

Stages 1–4 and 6–7 are on every Shield plan. The Edge Rules engine and JA3/JA4 fingerprint blocking unlock on Shield Business.

Features & benefits

Built to be switched on and forgotten

Mitigation that needs a human to notice an attack has already failed. Shield decides on its own, then tells you what it did.

Real-Time Detection & Mitigation

Attacks are classified and mitigated automatically in seconds, no ticket, no phone call, no waiting for an engineer to flip a switch.

Global Anycast Edge

A 120+ PoP anycast footprint across four continents absorbs attack traffic close to its source and serves real visitors from the node nearest to them.

Intelligent Layered WAF

OWASP Core Rule Set and our own signature engine run together, tuned per domain so protection gets stricter without getting noisier.

No Latency Penalty

Cacheable responses are served straight from the edge and skip inspection entirely, so protection routinely makes a site faster rather than slower.

Custom Edge Rule Engine

Write your own when / then policy, by path, country, header, method or ASN, and push it to every edge node without touching your application.

24/7 Security Operations

Real engineers watching real attack telemetry, with rule-efficacy reporting so you can see exactly what was blocked and why.

Pricing

Enterprise protection, priced honestly

Every plan includes the full Layer 3/4 and Layer 7 stack. You are paying for scale, control and how fast a human answers, not for whether you are protected.

Save 17% with yearly billing

Shield Pro

Production sites and stores that cannot go down

$ 82.50 /mo

$99.00 Save 17%

Get Shield Pro

Always-on L3 / L4 + Layer 7 mitigation
Up to 5 protected hostnames
ModSecurity + OWASP Core Rule Set
TOSCDN signature WAF, SQLi, XSS, RCE, traversal
Adaptive rate limiting + JS challenge
Verified good-bot allow-list (SEO-safe)
Global Protect under-attack mode
Always Online origin failover
Real-time attack analytics
24/7 ticket support

Shield Business

Multi-site platforms and APIs under constant pressure

$ 332.50 /mo

$399.00 Save 17%

Get Shield Business

Everything in Shield Pro
Up to 25 protected hostnames
JA3 / JA4 TLS fingerprint blocking
Custom Edge Rules engine (when / then)
Per-path and per-API rate-limit policies
Bot classifier with operator labelling
Custom CRS tuning + per-domain exclusions
Attack log export & rule-efficacy reporting
Priority support, 1-hour response
99.99% uptime SLA

Dedicated

Shield Enterprise

Dedicated capacity, named engineers, contractual SLA

$ 1,249.17 /mo

$1,499.00 Save 17%

Get Shield Enterprise or talk to our security team →

Everything in Shield Business
Unlimited protected hostnames
Dedicated scrubbing capacity
Custom mitigation playbooks per application
Named security engineer + quarterly review
24/7 SOC escalation, 15-minute response
Managed onboarding and migration
Private edge capacity on request
Contractual SLA with service credits
Invoice / PO billing

Prices shown in USD. Protection applies to any origin, on our network or anyone else's. Need more than Shield Enterprise, or a custom on-ramp? Talk to us.

FAQ

Questions, answered

Get behind the edge before the next attack

Onboarding is a DNS change. Protection is live in minutes, your application never changes, and real engineers are watching the telemetry 24/7.

Protect my site Talk to security

Stop DDoS attacks instantly.

Three layers, one edge

Website & API Protection

Network & DNS Protection

Infrastructure & Layer 3/4 Defence

Seven checks between an attacker and your application

JA3 / JA4 fingerprinting

Bot classification

ModSecurity + OWASP CRS

TOSCDN signature WAF

Edge Rules engine

Adaptive rate limiting

Global Protect challenge

Your origin, and Always Online if it falls over

Built to be switched on and forgotten

Real-Time Detection & Mitigation

Global Anycast Edge

Intelligent Layered WAF

No Latency Penalty

Custom Edge Rule Engine

24/7 Security Operations

Enterprise protection, priced honestly

Shield Pro

Shield Business

Shield Enterprise

Questions, answered

Get behind the edge before the next attack

Client Login

Choose Currency