NullWard
Self-hosted web application firewall and secure reverse proxy: OWASP Core Rule Set WAF, automatic TLS certificates, sign-in for any app (OIDC, LDAP/AD, email codes), threat intelligence and audit logging. One flat price for unlimited domains and applications.
From CAD 20.00 per month
Features
- Priority email support — Priority email support from our team is included with Professional and every plan above it. Personal and Small Business licenses are self-service and include no support.
- OWASP Core Rule Set WAF — The OWASP Core Rule Set v4 is available out of the box. Tune paranoia level and anomaly thresholds, run any service in audit-only mode first, and turn real events into precise exclusions in one click.
- Custom rule sets — Write your own SecLang rules with validation and performance hints, apply them globally or per service, and export or import them to share between deployments.
- Automatic TLS certificates — ACME certificates from Let's Encrypt, ZeroSSL, Google Trust Services or your own CA, with HTTP-01 and DNS-01 across eight DNS providers, per-service TLS policy and HSTS.
- Sign-in for any application — Put OIDC (Entra ID, Google, generic), LDAP / Active Directory, one-time email codes, Basic or header auth in front of an application, and pass the user's identity through, with no code changes.
- Threat intelligence and auto-blocking — Community threat feeds, IP reputation, geo-blocking and behaviour scoring that automatically blocks clients whose WAF hits, rate-limit violations and failed logins add up.
- Visibility and audit — Fleet and per-service dashboards, latency by pipeline stage, searchable request logs, an audit trail with field-level diffs, and SIEM forwarding over HTTP or syslog.
- Unlimited domains and applications — One flat price covers every domain and application you protect, on infrastructure you control.
- ML WAF (licensed) — A machine-learning classifier alongside the rule set detects obfuscated and novel attacks, learns each application's normal traffic, and tightens enforcement as it matures.
- Application tunnels (licensed) — Publish applications behind NAT or in private networks over outbound WireGuard tunnels, with no inbound firewall rules. Includes a Kubernetes operator.
- Waiting room and clustering (licensed) — Cap concurrent users during traffic spikes with a virtual waiting room. Peer-to-peer high availability clustering is available in beta.
- HTTP/3 (licensed, beta) — Serve applications over HTTP/3 (QUIC) alongside HTTP/1.1 and HTTP/2 for faster connection setup on mobile and lossy networks, and optionally reach backends over HTTP/3 too. Off until you enable it, globally or per service.
- Contractual SLA and named support — Multi-node deployments with a contractual uptime SLA, named support contacts and enhanced response commitments, agreed as part of an Enterprise quote.
One gateway in front of every web application NullWard is a self-hosted web application firewall and secure reverse proxy. One deployment sits in front of your applications and handles request inspection, TLS certificates, sign-in, threat intelligence and audit logging, all managed from a single dashboard. OWASP Core Rule Set v4, with custom rules, an audit mode for safe tuning, and exclusions created from real events. Automatic TLS certificates over ACME, including wildcards with DNS-01. Sign-in for any application: OIDC, LDAP / Active Directory or one-time email codes, with no code changes. Threat protection: threat feeds, IP reputation, automatic blocking of abusive clients, rate limiting, CAPTCHA challenges and malware scanning. Your traffic stays on infrastructure you control, with unlimited domains and applications. Free to use, with paid features NullWard is free to use, for both commercial and personal use. The paid features need a license, and any valid license unlocks all of them: the ML WAF, application tunnels, the virtual waiting room, high availability (beta) and HTTP/3 (beta). Deployment NullWard ships as container images and a Helm chart, with SurrealDB and Valkey. The documentation covers installation and configuration.
All products