Changelog

Trace a URL's full redirect chain, check robots/canonical directives, validate on-page SEO and social preview metadata, and scan for missing alt text or mixed content -- all in one pass. Check as Googlebot, Bingbot, or a standard browser to spot cloaking or bot blocking. No account needed.

Mute origin-health, SSL, WAF-spike, or repeat-offender alerts independently, redirect them to a different email without needing Pro, and adjust each type's threshold -- all from Alerts in the sidebar.

A one-click button on the WAF & Security tab fires a harmless test request at your live domain and confirms whether ShieldIngress actually caught it -- checks DNS, WAF status, and mode all in one shot.

The dashboard now tracks actual setup progress -- register, verify, deploy, enable WAF blocking -- instead of just disappearing the moment your first domain exists, configured or not.

Every domain's Analytics overview now shows a 30-day uptime percentage for its origin, plus a timeline of any down/recovered incidents.

A Monday summary of traffic, WAF blocks, and anything needing attention (SSL expiring, backend unhealthy) across every domain on your account. On by default -- one click to turn off from Alerts.

The Rule Builder's new Preview matches button checks a candidate rule against your domain's actual traffic from the last 7 days -- see roughly how often it would have fired, with sample matches, before it's ever live.

Turn on Go Live in WAF Events to watch blocked and flagged requests appear in real time as they happen, instead of refreshing the page.

Automatic alerts when a domain's blocked-request rate spikes, or one IP gets blocked repeatedly in a short window -- often the first sign of an active attack.

See request volume and WAF-block trends at a glance, plus every certificate approaching expiry -- not just the single soonest one.

Save a domain's rules and WAF settings as a reusable template, then apply it to any other domain in one click instead of reconfiguring by hand.

Select multiple domains in the dashboard table and block an IP address across all of them in one action, instead of repeating it domain by domain.

Press Ctrl+K (Cmd+K on Mac) from anywhere in the dashboard to jump straight to any domain or workspace by typing its name.

Create additional API tokens beyond your main key, each scoped to read-only or full access, and revoke any one of them individually without rotating your primary key.

Launched with a detailed guide for each free tool -- how to read your SSL Certificate Checker results, what every Security Headers Checker field actually protects against, and how to write a WAF rule with the Rule Builder.

Quick-apply country groups (EU, Five Eyes, sanctioned countries, and more) show up right in the country picker, alongside any custom groups you've saved yourself. One click instead of hand-picking a dozen countries.

Scope a rate limit to specific HTTP methods and countries, not just a path. Every limit can also run in log-only mode first -- see exactly what it would have blocked, with an X-RateLimit-Would-Block response header, before switching it to actually deny anything.

Full certificate chain, key type and size, fingerprints, TLS protocol support matrix, and OCSP stapling status -- for any domain, no account needed.

See at a glance how serious a blocked request was, and jump straight from a WAF event to its matching entry in Traffic Logs to see the full request in context.

Serve repeat requests straight from the edge instead of hitting your origin every time. Static assets are cached automatically; add your own rules for exactly what to cache and what to always skip.

Export your account's data or close your account any time, without needing to contact support.

Optional TOTP-based 2FA for every team member, with one-time backup codes if you lose your device. Turn it on per-person from Account Security.

The Revisions & Deploy panel now has a full diff view -- see exactly what changed between two revisions, grouped by section, with added/removed/changed rules called out individually.

Every plan now gets automatic email alerts the moment an origin goes down (or recovers) or a certificate fails to renew -- previously Pro-only. Pro adds a configurable webhook on top, for Slack, Discord, or your own tooling.

Check any site's HTTP response for HSTS, CSP, X-Frame-Options, and the other headers that actually matter -- and see exactly what's missing.

Fixed a bug where a domain's configured security headers weren't reliably reaching real requests. The Security Headers tab was also redesigned as a single list of status + one-click fixes.

Point a bare domain at your www. site (or anywhere else) without spending a full protected-domain slot on it -- Basic gets one dedicated redirect slot alongside its main domain.

Live platform health, visible without logging in -- linked from every page's footer.

Try Basic or Pro free for a week, no separate trial tier to figure out.

Generate a correct Coraza/ModSecurity SecRule from simple fields -- no SecLang syntax required. Geo Blocking and IP Access Rules also got saved country groups, bulk multi-value entry, allow-only IP rules, and manual rule ordering.