Docs · guide

Connect
in 5 minutes

From zero account to first request through the shield. We assume you already own a domain and can edit its DNS. If not - buy one from any registrar (e.g. Namecheap) and come back.

STEP 01

Register

Open https://anycast.ac/register. You'll need email, handle, and password. Handle is a short nickname shown in the panel and audit log. Password is stored as bcrypt hash (cost=12); plain-text is never persisted.

After registration you're automatically redirected to dash.anycast.ac. Same account, different entry point. Cookie lives on the entire .anycast.ac domain, so logging into marketing gives you the dashboard for free.

STEP 02

Create a site

In the dashboard hit + New site. A form opens. Fields to fill:

  • Domain - Your site's name (e.g. example.com). Without protocol or path.
  • Origin URL - Where your real server actually lives. Format http://1.2.3.4:8080 or https://server.example.net. We connect here from our edges (SE1/CH1/UK1/DE1).
  • TLS mode - acme (default) → auto Let's Encrypt on our side. Or byo → you upload fullchain+key via API.
  • Preset - Quick preset: easy for forums, normal by default, strict for APIs, paranoid during active attack. Change later in Rules.

Site starts in pending state - that means cert-worker has queued a Let's Encrypt issuance for you. Once DNS points at us (next step) and TLS is issued, state flips to active.

STEP 03

Set up DNS

Add a CNAME record in your domain's DNS zone:

shell
Name        Type     Value
─────────────────────────────────────────────────────────
example.com   CNAME    cname.anycast.ac
www           CNAME    cname.anycast.ac

cname.anycast.ac resolves to the nearest edge IP via BGP anycast. A client in Warsaw usually lands on SE1, from Lisbon on CH1, from Dublin on UK1, from Berlin on DE1.

If your registrar doesn't support CNAME on the apex domain, use ALIAS or ANAME, or change registrars. Cloudflare as free DNS won't work - you'd need to disable their orange proxy cloud (grey cloud).

STEP 04

Wait for the certificate

Cert-worker checks your domain's DNS every 30 seconds. As soon as the CNAME points at our anycast, it:

  1. Requests Let's Encrypt via ACME HTTP-01.
  2. Receives fullchain.pem + privkey.pem.
  3. Copies them to every edge via SCP.
  4. Reloads nginx and pushes site-registry refresh.
  5. Flips the site to active state in Postgres.

The whole process takes 30–90 seconds. If after 5 minutes your site is still pending - see the Troubleshooting section below.

STEP 05

Verify it works

shell
$ curl -I https://example.com
HTTP/2 200
server: fg-edge-se1
x-fg-route: ok
...

Headers server: fg-edge-* and x-fg-route confirm traffic flows through us. If you see your origin's headers directly (e.g. server: nginx/1.25), DNS hasn't propagated yet.

Also verify HTTP auto-redirects to HTTPS: curl -I http://example.com should return 301 Location: https://...

STEP 06

Configure rules

Dashboard → Sites → your site → Edit rules. What's here:

Rate per IP0–100 000

Max requests per IP per minute. 0 = no limit. Recommended: 120 for forums, 600 for APIs, 60 for biolinks.

Burst per IP0–200 000

One-off spike allowed on top of rate. Typically 2–3× of rate.

Proto ban threshold0–50

How many HTTP-protocol violations an IP can make (invalid Host, gibberish request-line) before a 60-second kernel ban. Recommended: 2.

Auto ban threshold0–10 000

How many soft violations (rate-overshoot, empty-UA) before a 1-hour full ban. Usually 50–100.

Deny CIDRs / Allow CIDRsfree text

List of CIDR blocks one per line. Allow takes precedence over Deny. Examples: 10.0.0.0/8, 2a02::/16.

Block empty UAtoggle

On by default. Drops requests with no User-Agent header - ~90% of all bots, low false-positive risk.

Allowed methodsCSV

Allowed HTTP methods comma-separated. Default GET,POST,HEAD,OPTIONS. Add PUT,DELETE,PATCH for APIs.

Max body KB0–100 000

Max POST body in kilobytes. 0 = no limit. For a regular site 2048 (2 MB) is plenty.

Challenge suspectstoggle

Suspicious IPs (by ASN, User-Agent, rate) get a silent JS challenge - transparent for humans, impassable for curl bots.

Under Attack Mode (UAM)toggle

PLATINUM mode. Every new IP sees an interstitial challenge (~1 second on the client) before reaching the site. Turn on during active attacks, turn off once it calms down. Trust cookie lasts 30 minutes.

STEP 07

Read the charts

On the site card - three bar charts: Requests, Blocked, Allowed. Ranges:

  • 60 sec - 6 bars × 10 seconds. Real-time observation.
  • 5 min - 10 bars × 30 seconds. 'What just happened'.
  • 1 hour - 60 bars × 1 minute. Half-hour / hour history.
  • 1 day - 144 bars × 10 minutes. Full day.
  • All time · by day - 30 bars, one per day. Month view.

Samples are written by a separate worker every 10 seconds directly from edge counters - charts start filling the moment a site is created, even with no traffic (0 is a valid point).

STEP 08

Troubleshooting

Site is pending for more than 5 minutes

The most common cause - DNS hasn't propagated yet. Check via an external resolver:

shell
$ dig +short example.com @8.8.8.8
cname.anycast.ac.
1.2.3.4

If you see your server's IP instead of cname.anycast.ac - the DNS change hasn't propagated yet. Wait out the previous record's TTL (usually 5–60 minutes).

Chrome opens fine, Firefox says "Not secure"

For a fresh domain behind our proxy, Google Safe Browsing reputation is zero - Chrome is chill about it, Firefox shows a warning. Reputation builds automatically in a few hours, or you can request a manual review in Google Search Console and Mozilla's Site Security Report.

"Host not served here" error

Edge got a request for a Host that's not in its site registry. Causes:

  1. Cert-worker hasn't finished - wait for active state.
  2. Push-refresh didn't arrive - within 30 seconds the edge pulls the new registry anyway.
  3. You're hitting www.example.com but only registered the apex example.com. Add a second site with www.

HSTS is locked on the wrong cert

If your browser grabbed an HSTS header before the Let's Encrypt cert was issued, it may complain about an invalid cert even after one exists. Clear HSTS locally:

shell
# Chrome / Chromium / Edge
chrome://net-internals/#hsts
→ Delete domain security policies: example.com

# Firefox
about:support → HSTS/HPKP clear site data

We hold HSTS on customer sites at 5 minutes so this issue clears itself quickly. Need full 1-year HSTS? Email support@ and we'll enable it after a config check.

UAM kicks me out of my own site

By-design - UAM challenges every new IP including yours. Two fixes:

  1. Solve the challenge once - you get a trust cookie for 30 minutes.
  2. Add your IP to Allow CIDRs in Rules - UAM won't fire for you at all.
STEP 09

Next

Read the policy and rules before running anything serious. Questions - support@anycast.ac. Real humans answer there.