What you bought, and how to put it in front of your site.

DEFLECTO is a reverse proxy with a web application firewall inside it. Once your hostname points at the network, every request for that hostname arrives at an edge node before it reaches you. The node forms one verdict per request on an escalating ladder, allow, log, challenge, block or drop, and only the requests that come through it intact are forwarded to your origin. Network layer floods do not get that far at all: they are discarded by a packet filter in the network driver, below the socket, so refusing a flood costs the proxy almost nothing and the flood never becomes work.

Two things are yours to do, and both are in the onboarding guide: point the hostname at the network, then close your origin so that it answers the network and nobody else. The commercial half is worth reading once and then forgetting. Your plan counts the legitimate requests we forward to your origin and counts nothing else, so a flood, a refused probe and a bot stopped at a challenge all cost you exactly nothing, for as long as the attack lasts.

Read the first one before you change any DNS. Read the second one if anything other than a browser talks to your site, which for most applications means a payment provider, a monitoring probe, or both.

Seven terms, used consistently across the panel, the invoices and the rest of these pages.

Origin

Your own server, the one that actually runs the application. DEFLECTO never replaces it, it stands in front of it. Once you are live its address should accept connections only from the network, which is step two of the onboarding guide and the step people skip.

Edge

The node a visitor connects to. It terminates TLS, forms a verdict on the request and forwards what survives. Packet filtering happens here as well, in the network driver below the socket, so a network layer flood is discarded before it becomes a connection anything has to read.

Challenge

A proof-of-work puzzle served in place of the page when a client looks automated but is not clearly hostile. A browser solves it with nothing to click and nothing to read. A block is the harsher verdict above it, and a challenge exists precisely so that the harsher one is needed less often.

Clearance

What a solved challenge earns. It is carried in a cookie so the same client is not asked again, and it expires, so it is a grant with a lifetime rather than a permanent pass.

Ward, and your quota

A ward is the spend unit, and one ward is one request delivered to your origin. Your plan’s monthly quota is a number of wards. A request that was challenged, blocked or dropped never reached you, so it spends none of them, however many of them arrive.

Forwarded request

A request that came through the pipeline intact and was handed to your origin. It is the only thing counted, because it is the only request your application had to serve.

Tenant

One protected property as the network holds it: its hostnames, the origins behind them, its rate and concurrency ceilings, the paths it has exempted from the challenge, and its own ward ledger. If you bought through a reseller rather than from us directly, you are a tenant under that reseller.

One consequence of the last two is worth stating on its own, because it is what people get wrong when they read an invoice: the number on it is not a traffic figure. A node can refuse millions of requests in the same hour it delivers a few thousand, and only the few thousand appear. If you want the traffic figure, the panel shows delivered, challenged, blocked and dropped side by side, and only the first of those spends a ward.