Product
Every request inspected at your edge, in under a millisecond
The KillTheBots agent runs beside your web server. Decisions are local, so there is no external hop, no shared proxy, and no traffic detour.
Country and network rules
Allowlist or denylist countries, pin trusted office CIDRs, and deny known abusive ranges. Rules evaluate before any scoring.
Signed intelligence feed
Tor exit nodes, commercial VPN ranges, open proxies and datacenter ASNs, delivered as signed releases the agent verifies locally.
Per-route rate limits
Protect login, search and checkout with independent windows. Hard limits block, soft limits challenge.
Transparent challenges
A lightweight JavaScript proof-of-browser with no puzzles, no third-party tracking, and a configurable session length.
Reputation scoring
Signals combine into a 0–100 score with your own challenge and block thresholds, so you decide how strict enforcement gets.
Insight mode first
Start in Insight to see what would have been challenged or blocked, then move to Protected or Full Protection when the numbers look right.
Versioned policy
Every policy change is versioned with an author and summary, and any version can be rolled back in a single click.
Privacy-conscious telemetry
Client IPs are truncated before storage. Events keep country, ASN, route and decision — not personal data.
The decision path
Rules are ordered so the cheapest and most explicit checks run first. A request that matches an exemption never reaches scoring, and a request that matches a hard deny never reaches your app.
How the security model worksRequest path
- VisitorHTTP request
- Nginxauth_request
- KillTheBots agentlocal decision
- AllowChallengeBlockOriginyour application