Documentation
Everything you need to put a site behind GuardX and run it day to day.
Getting started
- Create an account in the dashboard and pick a plan. We recommend turning on two-factor authentication in Settings.
- Choose Add domain. Enter the domain (for example
example.com), the public address of your origin server, and whether it speaks HTTP or HTTPS. - Follow the wizard: it prepares the certificate and shows the DNS records to create.
- Once DNS has propagated, traffic reaches GuardX first and clean requests are forwarded to your origin.
The origin must be a public IP address or hostname. Private, loopback and cloud-metadata addresses are refused.
DNS
| Record | Name | Value | Purpose |
|---|---|---|---|
| CNAME | your domain or subdomain | proxy.guardx.fr | Sends traffic through GuardX |
| TXT | _acme-challenge.<your domain> | value shown in the wizard | Proves ownership for a Let’s Encrypt certificate |
A CNAME is not allowed at the root of a domain at some DNS providers. Use their “CNAME flattening” or ALIAS record, or move the DNS to a provider that supports it. Keep a low TTL while you switch so you can roll back quickly.
Certificates
GuardX issues free Let’s Encrypt certificates using a DNS challenge and renews them automatically. Add the TXT record, then choose Verify; the check runs in the background and the page updates when it succeeds. You can also upload your own certificate and private key, and download your certificate bundle again after confirming your password. If your DNS is behind Cloudflare, the wizard can detect it and offer the matching setup.
Protection modes
- Normal: requests go through the firewall and rate limits; visitors see nothing.
- Under Attack Mode: a short browser check filters most bots before the request is forwarded.
- Captcha: a captcha stops what is left when an attack is still getting through.
- Automatic: GuardX raises the level when it detects an attack and lowers it again when traffic returns to normal.
Visitors who pass a check get a short-lived cookie so they are not asked again straight away. See the Cookie Policy.
Firewall
The web application firewall uses OWASP-based rules out of the box. From the dashboard you can set each rule group to block, log only, or off; add custom rules matching path, headers, IP, country and more; and define per-path exceptions for false positives. Every change is stored in a history from which you can roll back in one click. Some of these controls depend on your plan.
If a legitimate visitor is blocked, ask for the reference shown on the block page, find the event in the dashboard and add an exception for that path.
Analytics
For each domain the dashboard shows allowed and blocked requests, attack sources and a live feed, so you can see what was stopped and why.
Plans
Pro covers 1 domain, Business 5 and Enterprise 10. Business adds custom rules, per-rule actions and rule history; Enterprise adds per-endpoint rate limits, attack payload logging, client-side script monitoring and event export. Details and prices are in the pricing section; billing rules are in Billing & Cancellation.
Troubleshooting
- Certificate stays pending. The TXT record is missing, wrong, or not yet visible. Check it with a DNS lookup tool, wait a few minutes, then verify again.
- 502 or 504 errors. GuardX cannot reach your origin. Check that the origin address and protocol in the domain settings are right, that your server is up, and that its firewall allows GuardX.
- Redirect loop. Your origin forces HTTPS while the domain is set to talk to it over HTTP. Set the origin protocol to HTTPS.
- Real visitor IPs. GuardX forwards the client address in the
X-Forwarded-Forheader. Configure your web server to trust it from GuardX only. - Still stuck? Write to support@guardx.fr.