The platform

Every defense your sites need — running quietly inside them.

Install it once and let it run. Policies, alerts, and reports do the work — your sites stay protected without asking for your attention.

NormalizeEvaluateDecideEnforceTelemetry

Everything it does

A complete WAF — not a plugin with a few rules.

Everything ships in the same install — the standard protections, plus what only an in-stack firewall can do.

OWASP CRS rule engine

SQLi, XSS, RFI/LFI, command-injection and path-traversal inspection from the OWASP Core Rule Set.

›For the technical reader

A signed system-rule subset of the OWASP CRS across six matcher classes, with per-rule parameter exclusions so legitimate app traffic isn't caught.

Anomaly scoring

Decisions rest on accumulated evidence, not a single string match. Rules contribute weighted scores, and low-confidence observations are recorded for review instead of blocking anyone.

›For the technical reader

Each request is scored across rule families against a block threshold. Observation-class rules add forensic detail to events but never block on their own.

Full request-body inspection

Deep inspection of JSON, REST and GraphQL payloads.

›For the technical reader

Reads the request body once — form posts, JSON nested up to 20 levels, and GraphQL — capped at 1 MB and 1,000 values, then runs the same rule engine over every field. Oversized bodies are never silently waved through: they trigger an explicit oversize decision. Only field names, rule IDs and hashed values are stored — raw bodies never touch disk.

AI & bot defense

Classifies and blocks automated clients — scrapers, scanners, credential bots.

›For the technical reader

Four additive layers — blank-UA check, a signature pack of good/bad/scanner agents, DNS verification, and behavioral scoring (missing headers, probe-path scan rate). Claimed good bots like Googlebot are verified by reverse-and-forward DNS, so real crawlers never get blocked.

Brute-force & login protection

Rate-limits and locks down login endpoints against credential-stuffing.

›For the technical reader

Failed attempts count per hashed IP and lockouts expire on their own — no permanent bans from a mistyped password.

Geo-blocking

Allow or block by country, tuned per site.

›For the technical reader

Country is resolved locally from an auto-downloaded database — no third-party lookup in the request path, and the database refreshes monthly on its own.

Five-stage pipeline

Every request normalized, evaluated and decided before your app runs.

›For the technical reader

Normalize → evaluate → decide → enforce → telemetry. The engine is pure platform-agnostic PHP; each platform adapter feeds it a normalized request snapshot, so the same core runs everywhere.

Geo / country blocking — eight countries blocked across the fleet, shown on a world map with a per-country list

Geo-blocking — per-site country rules

Custom rules

Write your own tenant rules on top of the managed set, per site.

›For the technical reader

Tenant rules are signed separately from system rules and applied after them. A matching allow rule wins over every block rule, so false-positive fixes short-circuit cleanly.

Instant policy sync

Change a rule in the dashboard and it's enforcing on the site in seconds — not on the next scheduled check.

›For the technical reader

The control plane notifies the site over an authenticated channel; the site pulls the new policy and verifies its RSA signature before applying it. Regular polling backstops the push, so a missed notification only means a short delay.

IP allow & blocklists

Allow or block by IP or CIDR range, with temporary bans that expire on their own.

›For the technical reader

The allowlist wins over everything — a trusted IP is never rate-limited or geo-blocked. IPv4 today.

Rate limiting

Per-endpoint throttling backed by atomic counters.

›For the technical reader

Keyed by route group and hashed IP per time window, enforced with atomic counters so concurrent requests can't race past the limit. Over-limit requests get a 429.

Fingerprint blocking

Block repeat attackers by client fingerprint.

›For the technical reader

A fingerprint keys on hashed IP plus UA family, so a repeat attacker rotating URLs still matches. Allowlisted fingerprints short-circuit the pipeline entirely for instant false-positive recovery.

Custom rule editor — creating a Challenge /checkout rule

Custom rules — tenant rules on top of the managed set

File-upload protection

Blocks malicious uploads before your app touches them: dangerous extensions, disguised file types, embedded code.

›For the technical reader

Checks final and double extensions, verifies magic bytes against the declared type, and scans content for embedded <?php / <script / executable headers — the polyglot check that catches a PHP file dressed as a JPEG. A SHA-256 "mark safe" allowlist handles legitimate edge cases — audit-logged.

Two-factor authentication

Dashboard-wide control — coming soon

Authenticator-app codes with backup codes on protected login flows.

›For the technical reader

TOTP with per-role enforcement and a rollout grace period. XML-RPC password auth is blocked for enrolled accounts so 2FA can't be sidestepped — Application Passwords keep working.

Login audit log

Every login attempt recorded — hashed IP, country, user agent — with one-click unlock of locked-out IPs.

›For the technical reader

Successes and failures both log. IPs are stored as per-site keyed hashes, so the audit trail itself leaks nothing if exposed.

Never locked out

A firewall that can lock out its own admin is a liability. If it ever happens here, there's always a way back in — no FTP required.

›For the technical reader

Three escape hatches: disable the firewall or clear login lockouts for a site remotely from the dashboard; unlock a locked-out IP with one click in wp-admin; disable a user's 2FA over WP-CLI as the last resort.

Security headers

Turn on hardened response headers per site — enforced in Protect mode.

›For the technical reader

Delivered twice for reliability — written to .htaccess on Apache/LiteSpeed and set at PHP runtime — with full HSTS controls including preload. nginx gets generated config guidance.

Live events feed — a blocked SQLi attempt

What running inside unlocks

Capabilities an edge firewall cannot reach — because it never gets inside the site.

Coming soon

Virtual patches that auto-update

Patch the vulnerable plugin from inside the site. A proxy can't reach it; we run where it lives.

Coming soon

Vulnerability & malware scanning

Continuous scanning for known-vulnerable components across every site you manage.

Coming soon

Headless-WordPress support

Protection for decoupled WordPress front-ends.

Coming soon

IP & network reputation

Score requests by ASN and network history before the rules even run. ASN already shows in every event for visibility; enforcement is what's coming.

Secure by design

Protecting your sites — and your visitors' privacy.

Site data stays scoped to your account. What reaches your dashboard is hashed with a key that never leaves the site — so even we can't turn it back into a real visitor.

Signed policies

Every rule set is cryptographically signed; the site verifies it before applying.

›For the technical reader

RSA signatures verified against the site's public key. System rules are signed by Domain Dome, custom rules by the tenant; any tampered or unsigned policy is rejected and the last known-good policy is kept.

Privacy by design

IPs and user-agents are hashed per site with a key that never leaves the site. A leaked database reveals no raw IPs.

›For the technical reader

A per-site keyed HMAC-SHA256 where the secret never leaves the site, replacing plain unsalted hashing.

Audited IP reveal

IPs are hashed by default — but when an investigation needs the real address, reveal it with one click. Every reveal is recorded, capped, and the raw IP deletes itself on the schedule you choose.

›For the technical reader

The dashboard never stores raw IPs. A reveal asks the site itself, which answers from its own local store. Each reveal writes an audit entry — who, when, which event. Per-user and per-tenant caps apply, and raw addresses auto-purge after 30, 60 or 90 days, set per site.

Full inspection, minimal retention

Every request is read in full — but only field names, rule IDs, paths and hashed IPs are stored. Raw request bodies are never written to disk.

›For the technical reader

Inspection can read the whole request; storage keeps field names, rule id, path, hashed IP and timestamp — never raw bodies.

Coming soon

Audit-ready by default

Every security event on every site is logged with a timestamp, rule ID and outcome — exportable whenever a client asks.

›For the technical reader

Logins, blocks, policy changes and false-positive clears are all recorded. Records carry hashed identifiers only, so the audit trail itself discloses nothing if exposed.

Fail-open by design

If the firewall ever errors, your site stays up.

›For the technical reader

The WAF bootstrap is wrapped to catch any error and let the request through rather than crash the site. A storage driver cascade (MySQL → SQLite → file) keeps it running across hosts.

Works through outages

If our control plane vanished tomorrow, your sites would keep enforcing the last signed policy — indefinitely. Even a brand-new install that has never connected still blocks with its built-in signed baseline rules.

›For the technical reader

Policy and threat definitions cache locally and fail static, and a signed seed rule set ships inside the plugin, so enforcement never depends on connectivity. Definition updates are RSA-signed with anti-rollback version gating, and feed-supplied patterns run under bounded regex limits so a hostile pattern can't hang a request. Telemetry spools locally until connectivity returns — and the site's check-in honestly reports a degraded state rather than pretending all is well.

For developers, freelancers & agencies

Your clients see you. We stay behind you.

Run every client’s protection from one dashboard, under your brand, at a margin you set.

Fleet dashboard — every client site behind one login: policy, live events, down detection.

Set policy once — apply rules fleet-wide, stage in Monitor, enforce when you’re sure.

Co-branded reports and block pages — “Secured by Domain Dome · Managed by [Your Brand].”

See how it works for web professionals →

clientco.com/wp-login.php

403 Forbidden

This request was identified as a potential threat and stopped before it reached the site.

Secured by Domain Dome · Managed by [Your Agency]

Ray-ID: 7f3a91c2e4
Reason: sqli_rule_942100

What your client's visitor sees — your brand, our engine.

How it works

Every request, inspected in five stages.

Every request is decoded, evaluated and decided on before your application runs. Allowed, challenged or blocked — the verdict is reached inside your site.

Any platform

One core. A thin adapter per platform.

One core does the security work. A thin adapter connects it to each site and every site reports to one dashboard.

Platform-agnostic core

Does all the security work

Thin adapter

WordPress, WooCommerce, and more

One dashboard

Every site, one control center

Live now

WordPress

Live

WooCommerce

Live

Coming soon

Custom PHP

Coming soon

Node.js

Coming soon

APIs

Coming soon

Need a platform we don't list yet?

Request a platform →

›For the technical reader

The core is pure PHP with no CMS imports. Each adapter implements eight contracts — request provider, response enforcer, storage, telemetry, identity, policy loader, geo resolver and ASN resolver. WordPress is the first adapter (a must-use plugin); a universal-PHP adapter is planned to cover Laravel, Drupal, Magento and other PHP apps. Non-PHP runtimes are on the roadmap.

See it running on your sites.

Book a demo, or grab early access.

Book a Demo

No DNS changes. No rerouting. Installs in minutes.