OPENWAF
EspañolES Request early access Menu
Early access · free, no limits

The web application firewall and DNS for agencies that run many websites

Point a domain at your two OpenWAF nameservers and its sites get a web application firewall, rate limits, an access gate for admin areas and automatic TLS. Every change is versioned, signed and can be rolled back in one step.

Request early access See how it works

Hosted in the EU (Germany). Nothing to pay and no card needed during early access.

client-shop.exampleExample
Your nameservers
  • faros.ns.openwaf.dev
  • polaris.ns.openwaf.dev
  • Web application firewallActive · medium
  • TLS certificateLet’s Encrypt · auto-renew
  • Access gate/wp-admin
  • ConfigurationSigned · Ed25519
Illustrative example: one nameserver pair for every client domain.
Onboarding

Two nameservers. That’s the whole setup.

No agents on your servers and no code changes. OpenWAF becomes the authoritative DNS for the domain and sits in front of the hostnames you choose.

  1. Get your nameserver pair

    Your account has a fixed pair, such as faros.ns.openwaf.dev and polaris.ns.openwaf.dev. The same pair works for every domain you bring.

  2. Change the nameservers

    At the domain’s registrar, replace the current nameservers with your pair. When the delegation is visible, the zone becomes active.

  3. Choose what to protect

    Mark hostnames as proxied: their traffic goes through our edge nodes, with the WAF and a certificate issued automatically. Other records are answered as plain DNS.

How a request reaches your site through OpenWAFA visitor looks up the domain on your OpenWAF nameservers, connects over HTTPS to an OpenWAF edge node in Germany, which applies TLS, the WAF, rate limits and the access gate, and forwards only allowed requests to your origin. The control plane sends the edge nodes configuration signed with Ed25519.VisitorBrowser or appYour nameserversfaros.ns.openwaf.devpolaris.ns.openwaf.devOpenWAF edge · GermanyTLS with Let’s Encrypt certificatesWAF · rate limits · access gateIP, country and threat-feed rulesControl planeVersions, history, rollback and audit logYour originAny server, any stack1 · DNS2 · HTTPS3 · AllowedSigned config · Ed25519How a request reaches your site through OpenWAFA visitor looks up the domain on your OpenWAF nameservers, connects over HTTPS to an OpenWAF edge node in Germany, which applies TLS, the WAF, rate limits and the access gate, and forwards only allowed requests to your origin. The control plane sends the edge nodes configuration signed with Ed25519.VisitorBrowser or app1 · DNSYour nameserversfaros.ns.openwaf.devpolaris.ns.openwaf.dev2 · HTTPSOpenWAF edge · GermanyTLS with Let’s Encrypt certificatesWAF · rate limits · access gateIP, country and threat-feed rules3 · AllowedEd25519Your originYour serverControl planeVersions · audit
Proxied hostnames resolve to our edge nodes; DNS-only records are answered exactly as you define them.
What you get

Everything a client site needs in front of it

One service for the firewall, the DNS and the certificates, with the same controls for every site.

See all features

Built for agencies

Made for teams that look after dozens of client sites

Most firewalls are designed around one company and one website. OpenWAF starts from an agency’s day-to-day: many domains, many stacks and several people making changes.

On the way Coming soon

  • Sign-up with e-mail, Google or GitHub
  • Web dashboard at app.openwaf.dev
  • Bulk zone onboarding
  • DNS editor
  • Sub-accounts per end client
  • White label
  • One nameserver pair for every client

    Give all your clients the same two nameservers. The registrar change is the only step on their side.

  • Presets per stack

    Start each site from a WordPress, Next.js, static or generic preset, then adjust.

  • Changes you can explain

    Mandatory change reasons, history and the audit log answer “who touched this site, and why?”

  • Undo without drama

    If a change breaks something, roll the site’s configuration back in one step.

  • API and CLI

    Automate onboarding and changes with the API or the openwaf-cloud ctl command-line tool.

Security and data

Designed to fail safe, operated from the EU

The edge keeps protecting your sites even when the control plane can’t be reached, and your data is stored in Germany.

  • Data in the EU

    Edge nodes and DNS servers run on Hetzner in Germany, and your data is stored in the EU (Germany).

  • Signed, last-known-good

    Nodes verify every configuration document with Ed25519 and keep serving the last valid one if the control plane is unreachable.

  • Fast, traceable changes

    Changes reach every node in under a minute, each recorded with its author and reason.

  • A processor, with a DPA

    For your clients’ traffic we act as a processor under a Data Processing Agreement.

Read about security

Bring your agency’s sites into early access

OpenWAF is free with no limits while it is in early access. Tell us about your agency and the sites you manage, and we will set up your account and your nameserver pair.

Request early access
FAQ

Questions agencies ask us

What does “early access” mean?

OpenWAF is running and protecting real sites, but sign-up isn’t self-service yet and some parts, like the web dashboard, are still on the way. We set up accounts by hand: write to [email protected].

It is free and without limits, under the fair-use rules of the Acceptable Use Policy.

Do I have to change the nameservers? Can I use a CNAME instead?

Today onboarding is by nameservers only: the domain is delegated to your OpenWAF pair and we answer all of its DNS. That is what lets us issue certificates automatically and switch proxying on or off per record.

Will moving the nameservers break e-mail or other services?

Not if the zone has the same records as before. Records that aren’t proxied, like MX for e-mail, are answered exactly as you define them. Review the zone before changing the nameservers.

Where do you run?

Edge nodes and DNS servers are in Germany, on Hetzner. We don’t have an anycast network yet; more locations are planned.

What happens if your control plane goes down?

Edge nodes keep serving with the last valid, signed configuration they received. You can’t make changes until it is back, but traffic keeps flowing and stays protected.

Do you cache our content?

No. OpenWAF is a firewall and reverse proxy: requests are inspected and forwarded to your origin. Responses can be compressed with gzip or Brotli, but they aren’t cached.

Can our clients log in?

Not today: only the agency manages the account. Sub-accounts per end client and white label are coming.

How will pricing work later?

Paid plans will come later and prices aren’t set yet. We will tell you at least 30 days before any paid plan applies to your account, and nothing will be charged without your explicit agreement. See Pricing.