First steps
1. Sign up
Sign up with your email address or a Google account. We send a 6-digit code to verify the address; it's valid for 15 minutes. Your sites go online only once the address is verified.
2. Add your site
In Sites → Add a site, enter:
- the domain names of the site, for example
example.comandwww.example.com(Free allows two), - your server's address, the IP address or name with its port, for example
203.0.113.10:443, - the connection to your server: automatic (recommended: HTTPS, verifying your server's certificate when it can be verified), HTTPS verified, HTTPS not verified, or unencrypted HTTP.
A new site starts protecting at once: attack signatures active at medium sensitivity, the bot model only scoring. If you'd rather watch first, switch the site to monitor mode on its Security tab: the protection then only records what it would have stopped.
3. Point the domain to us
Follow Pointing a domain to rexguard. Once the domain names show online, visitors reach your site through us.
4. Your server and visitors' addresses
Your server now gets requests from our servers. The visitor's address arrives in the X-Forwarded-For and X-Real-IP headers, and whether they used HTTPS in X-Forwarded-Proto; set your web server or application to read them (for nginx, the real_ip module).
5. Check the first traffic
The site's Traffic tab shows the requests over time, what the protection decided, countries and response times; paid plans also see each single request with its reason, for 14 days. If a legitimate request was stopped, add an exception to that signature or an allowing rule on the Security tab.
Email alerts tell you when something needs you (a certificate problem, DNS that no longer points to us); you can switch each one off under Account.