Free tier is backFree tier is back: protect one site for 5 days at no cost.Try it
anycast.ac
Log inProtect a site

Connect in 5 minutes

From zero account to first request through the shield. We assume you already own a domain and can edit its DNS. If not - buy one from any registrar (e.g. Namecheap) and come back.

STEP 1

Register

Open https://anycast.ac/register. You'll need email, handle, and password. Handle is a short nickname shown in the panel and audit log. Password is stored as bcrypt hash (cost=12); plain-text is never persisted.

After registration you're automatically redirected to dash.anycast.ac. Same account, different entry point. Cookie lives on the entire .anycast.ac domain, so logging into marketing gives you the dashboard for free.

STEP 2

Create a site

In the dashboard hit + New site. A form opens. Fields to fill:

  • Domain Your site's name (e.g. example.com). Without protocol or path.
  • Origin URL Where your real server actually lives. Format http://1.2.3.4:8080 or https://server.example.net. We connect here from our edge (DE1 · Frankfurt).
  • TLS mode acme (default) → auto Let's Encrypt on our side. Or byo → you upload fullchain+key via API.
  • Preset Quick preset: easy for forums, normal by default, strict for APIs, paranoid during active attack. Change later in Rules.
Site starts in pending state - that means cert-worker has queued a Let's Encrypt issuance for you. Once DNS points at us (next step) and TLS is issued, state flips to active.

STEP 3

Set up DNS

Add a CNAME record in your domain's DNS zone:

Name        Type     Value
─────────────────────────────────────────────────────────
example.com   CNAME    cname.anycast.ac
www           CNAME    cname.anycast.ac

cname.anycast.ac resolves to our Germany edge (DE1 · Frankfurt) via BGP anycast.

If your registrar doesn't support CNAME on the apex domain, use ALIAS or ANAME, or change registrars. Cloudflare as free DNS won't work - you'd need to disable their orange proxy cloud (grey cloud).

STEP 4

Wait for the certificate

Cert-worker checks your domain's DNS every 30 seconds. As soon as the CNAME points at our anycast, it:

  • Requests Let's Encrypt via ACME HTTP-01.
  • Receives fullchain.pem + privkey.pem.
  • Copies them to every edge via SCP.
  • Reloads nginx and pushes site-registry refresh.
  • Flips the site to active state in Postgres.

The whole process takes 30-90 seconds. If after 5 minutes your site is still pending - see the Troubleshooting section below.

STEP 5

Verify it works

$ curl -I https://example.com
HTTP/2 200
server: fg-edge-se1
x-fg-route: ok
...

Headers server: fg-edge-* and x-fg-route confirm traffic flows through us. If you see your origin's headers directly (e.g. server: nginx/1.25), DNS hasn't propagated yet.

Also verify HTTP auto-redirects to HTTPS: curl -I http://example.com should return 301 Location: https://...

STEP 6

Configure rules

Dashboard → Sites → your site → Edit rules. What's here:

Rate per IP0-100 000
Max requests per IP per minute. 0 = no limit. Recommended: 120 for forums, 600 for APIs, 60 for biolinks.
Burst per IP0-200 000
One-off spike allowed on top of rate. Typically 2-3× of rate.
Proto ban threshold0-50
How many HTTP-protocol violations an IP can make (invalid Host, gibberish request-line) before a 60-second kernel ban. Recommended: 2.
Auto ban threshold0-10 000
How many soft violations (rate-overshoot, empty-UA) before a 1-hour full ban. Usually 50-100.
Deny CIDRs / Allow CIDRsfree text
List of CIDR blocks one per line. Allow takes precedence over Deny. Examples: 10.0.0.0/8, 2a02::/16.
Block empty UAtoggle
On by default. Drops requests with no User-Agent header - ~90% of all bots, low false-positive risk.
Allowed methodsCSV
Allowed HTTP methods comma-separated. Default GET,POST,HEAD,OPTIONS. Add PUT,DELETE,PATCH for APIs.
Max body KB0-100 000
Max POST body in kilobytes. 0 = no limit. For a regular site 2048 (2 MB) is plenty.
Challenge suspectstoggle
Suspicious IPs (by ASN, User-Agent, rate) get a silent JS challenge - transparent for humans, impassable for curl bots.
Under Attack Mode (UAM)toggle
PLATINUM mode. Every new IP sees an interstitial challenge (~1 second on the client) before reaching the site. Turn on during active attacks, turn off once it calms down. Trust cookie lasts 30 minutes.

STEP 7

Read the charts

On the site card - three bar charts: Requests, Blocked, Allowed. Ranges:

60 sec
6 bars × 10 seconds. Real-time observation.
5 min
10 bars × 30 seconds. 'What just happened'.
1 hour
60 bars × 1 minute. Half-hour / hour history.
1 day
144 bars × 10 minutes. Full day.
All time · by day
30 bars, one per day. Month view.

Samples are written by a separate worker every 10 seconds directly from edge counters - charts start filling the moment a site is created, even with no traffic (0 is a valid point).

STEP 8

Troubleshooting

  • Site is pending for more than 5 minutes
  • Chrome opens fine, Firefox says "Not secure"
  • "Host not served here" error
  • HSTS is locked on the wrong cert
  • UAM kicks me out of my own site

STEP 9

Next

Read the policy and rules before running anything serious. Questions - support@anycast.ac. Real humans answer there.