Quick Start

Get your first service protected in under 5 minutes.

1. Create an account

Choose a service

Plans & Limits

Domain Protection

Protect your website with WAF, DDoS mitigation, automatic SSL and DNS management.

How it works

When you add a domain, you point your nameservers to ShieldFlare. All DNS traffic then goes through our infrastructure.

Adding a domain

Proxy mode

When you enable proxy mode on a DNS record, traffic goes through ShieldFlare's DDoS protection and WAF.

SSL configuration

IP Guard

Hide your server's real IP address behind a ShieldFlare dedicated IP using an encrypted tunnel.

How it works

Installing the Agent

The ShieldFlare Agent runs on your server and sets up the encrypted tunnel to our Edge.

Linux

# Download and install the agent
curl -fsSL https://shieldflare.nl/agent/install.sh | bash

# Or download manually
wget https://shieldflare.nl/agent/sf-agent-linux-amd64
chmod +x sf-agent-linux-amd64
./sf-agent-linux-amd64 --config /etc/shieldflare/agent.json

Windows

# Download the Windows agent
Invoke-WebRequest -Uri "https://shieldflare.nl/agent/sf-agent-windows-amd64.exe" -OutFile "sf-agent.exe"
.\sf-agent.exe --config C:\ShieldFlare\agent.json

Agent config file

{
  "tunnel_id": "SF-XXXXXXXX",
  "edge_ip": "edge.shieldflare.nl",
  "edge_port": 7777,
  "tunnel_ip": "10.1.0.2",
  "session_key": "your-session-key",
  "api_url": "https://shieldflare.nl",
  "kill_switch": true
}

Firewall rules

You can add custom firewall rules per IP Guard tunnel.

Game Servers

Protect your game server from DDoS attacks with a dedicated ShieldFlare IP.

Supported games

Adding a game server

ShieldFlare Proxy

ShieldFlare Proxy is a high-performance reverse proxy written in Go, as a replacement for Apache and Nginx.

Features

Config file format

Site configs are stored in /etc/shieldflare-proxy/sites-available/.

# /etc/shieldflare-proxy/sites-available/example.com.conf

server_name example.com www.example.com
ssl on
redirect_http on
gzip on

# IP access control
allow 1.2.3.4
deny all

# URL redirects
redirect /old-page /new-page 301

# Custom error pages
error_page /var/www/errors/

location /socket.io/ {
    proxy http://127.0.0.1:3000/socket.io/
    websocket on
}

location /api/ {
    # Load balancing — meerdere backends
    upstream http://127.0.0.1:3000/
    upstream http://127.0.0.1:3001/
    rate_limit 100
    max_body 10mb
}

location /static/ {
    static /var/www/mysite/public/
    cache 3600
    add_header X-Cache-Control public
}

location / {
    proxy http://127.0.0.1:3000/
    spa on
}

Site-level options

Location options

Load balancing

Add multiple upstream directives to distribute traffic across multiple backends.

location / {
    upstream http://server1.example.com:3000/
    upstream http://server2.example.com:3000/
    upstream http://server3.example.com:3000/
}

IP access control

# Allow only specific IPs
allow 1.2.3.4
allow 5.6.7.8
deny all

# Block specific IP
deny 1.2.3.4

sf-proxy CLI

# List all enabled sites
sf-proxy list

# Enable a site
sf-proxy enable example.com

# Disable a site
sf-proxy disable example.com

# Reload config (without downtime)
pkill -HUP -f sf-proxy

Migrating from Apache

ShieldFlare Access

Zero Trust network access: connect your servers in a private network without opening ports.

What is Zero Trust?

Traditional VPNs give full network access once connected. Zero Trust means every connection is individually verified.

Setting up a network

WAF Web Application Firewall

The ShieldFlare WAF filters malicious requests before they reach your server.

Default rules

Custom rules

You can add custom WAF rules per domain under Domains → WAF.

DDoS Protection

ShieldFlare automatically detects and mitigates DDoS attacks on all layers.

Layers protected

SSL / TLS

ShieldFlare provides automatic SSL certificates for all protected domains.

Bot Protection

ShieldFlare's bot protection uses JavaScript challenges to distinguish real visitors from automated bots.

How to enable

Go to Domains → your domain → Settings → Bot Protection and toggle it on.

API Reference

The ShieldFlare API lets you manage your services programmatically.

Authentication

All API requests require an API key in the Authorization header.

curl https://shieldflare.nl/api/domains \
  -H "Authorization: Bearer sf_your_api_key"

Creating an API key

Endpoints

Webhooks

Webhooks send HTTP POST requests to your URL when events occur in ShieldFlare.

Available events

Webhook payload example

{
  "event": "attack.detected",
  "timestamp": "2026-10-10T14:00:00Z",
  "data": {
    "domain": "example.com",
    "source_ip": "1.2.3.4",
    "requests_per_minute": 5000,
    "mitigated": true
  }
}

FAQ

How long does DNS propagation take?

Typically between 5 minutes and 24 hours, depending on your current DNS TTL values.

Does my server need to be accessible from the internet?

For domain protection: yes. For IP Guard: no, the agent connects outbound to our Edge.

Can I use ShieldFlare with my existing SSL certificate?

Yes. Set the SSL mode to Full or Full Strict and keep your existing certificate on your server.

Does ShieldFlare support IPv6?

IPv6 support is on our roadmap.

How do I cancel my subscription?

Go to Dashboard → Billing and click Cancel subscription.

Troubleshooting

Website not loading after adding domain

IP Guard tunnel not connecting

systemctl status shieldflare-agent

journalctl -u shieldflare-agent -n 50

SSL certificate not working

ShieldFlare uses Let's Encrypt for automatic SSL. Make sure port 80 is accessible (needed for the ACME challenge).