TotalHealTrafficShield

How it works

1. ScoreEvery request gets a bot score: human, unknown, automated or verified crawler.
2. LogBot management starts in log mode; enforcing needs a reason and is audited.
3. ChallengeSuspicious clients get the self-hosted browser check; people pass without doing anything.
4. EscalateUnder a flood the edge moves from elevated to under attack, then steps down when it ends.

Reference architecture

Key capabilities

• Bot score for every requestHeaders, header order, client hints, behaviour and headless or automation signals (and TLS fingerprints when TLS ends at the edge) give each client a score: human, unknown, automated or verified crawler.
• Verified search crawlersSearch crawlers are verified by reverse DNS; clients that only claim to be a crawler are flagged.
• Own browser check, no CAPTCHAA self-hosted browser check and proof-of-work challenge with no third-party script; a person passes it without doing anything and gets a clearance for an hour.
• Log first, enforce when readyBot management starts by scoring and reporting only; switching an app to enforce needs a reason and is audited.
• Credential-stuffing protectionOne address trying many user names with many failures on a sign-in page — or a wave spread across addresses — is detected, then challenged or blocked.
• Adaptive Layer 7 DDoSA learned traffic baseline per app and path; under a flood the edge escalates by itself from elevated to under attack (every client without clearance is checked), and steps down when the flood is over.
• Under-attack modeTurn on under-attack mode by hand for up to 72 hours, with a reason; it is audited.
• Measured on our test edgeIn our 25 Oct 2026 run, a 70-requests-a-second page flood was challenged 21.6 seconds after it started and none of it reached the site after that; every real browser that was checked during the attack passed on its own; a credential-stuffing replay was flagged after 8 failed sign-ins.
• Alerts next to your other alertsBot, credential-stuffing and flood detections become alerts with MITRE ATT&CK mapping, with bot traffic, top clients, sign-in attempts and attack episodes in the console.

Deployment options

System requirements

Technical specifications