RexOS Shield security
Attacks stop at the door, long before they reach the server.
Every request to this site is checked by 12 layers of protection, from the network edge to the code that answers it. Real players and search engines pass without noticing.
- Watched 24 hours a day
- OWASP Top 10 covered
- HTTPS only, with HSTS
- Two-step login
- Attackers reported with evidence
What Shield stopped this week
Counted on this site by Shield itself. Verified search engines and real visitors are not in these numbers.
- 7,011Sun
- 8,291Mon
- 7,842Tue
- 8,359Wed
- 10,260Thu
- 12,986Fri
- 1,193Today
Today, by type
- SEO scrapers
- 980
- Attacks stopped by the firewall
- 181
- Bad bots and fake browsers
- 25
- Forged requests at the edge
- 5
- Banned repeat attackers
- 1
- Failed human checks
- 1
2,987 verified search and AI crawler visits let in today
Reported this month, by category
- Port Scan110
- Web App Attack110
- Exploited Host54
- Bad Web Bot37
How a request is checked
Each visit travels this path in a few milliseconds. A request that fails a step goes no further.
- Edge
Forged and broken requests are dropped.
- Reputation
Known bad networks are refused.
- Browser check
The browser must match its device and network.
- Firewall
Headers, forms and API bodies are unpacked and inspected.
- Limits
Floods and password guessing are throttled.
- Application
The page is built with safe queries only.
- Leak check
The answer is checked before it leaves.
Passed all seven: the page is served. Search engines and AI crawlers are verified at step 3 and never slowed down.
What it stops
The attacks we see most often, and what happens to each one.
| Threat | What it looks like | What Shield does |
|---|---|---|
| SQL injection | Database commands hidden in a form, link or API call. | Unpacked, recognised and blocked before any query runs. |
| Cross-site scripting | Script code slipped into a review, a profile or a link. | Blocked on the way in, and every page escapes what it prints. |
| Remote code execution | Shell commands or code sent to make the server run them. | Recognised in every input and blocked at the firewall. |
| Secret file probes | Requests for .env files, backups, wp-config and admin tools. | Blocked on sight. Repeat scanners are banned and reported. |
| Password guessing | Thousands of logins from rotating addresses. | Throttled, then locked out. Two-step login stops stolen passwords. |
| Scrapers and fake bots | A bot pretending to be Googlebot or a normal browser. | Checked against its network and device. Fakes are stopped. |
| Tor and proxy abuse | Attacks hidden behind Tor, VPNs and rented servers. | A human check first. Most automated tools give up there. |
| Application floods | A burst of heavy requests meant to slow the site down. | Rate limits per address, then an automatic lockdown. |
| Spam and fraud | Fake reviews, ticket spam and abused orders or rewards. | Screened on submit. Fraudulent orders are flagged and reported. |
Hidden attacks are unpacked first
Attackers disguise their code so simple filters miss it. Shield decodes every layer before it decides. These three are real tests from our last review.
%2527%20UNION%2F**%2FSELECT%20password%20FROM%20usersreads as' union select password from usersBlocked: SQL injection&lt;svg onload=alert(1)&gt;reads as<svg onload=alert(1)>Blocked: Cross-site scripting／ｅｔｃ／ｐａｓｓｗｄreads as/etc/passwdBlocked: System file access
Every layer, one job
Each layer covers a different way in. Together they protect the site, the launcher and every account.
Edge filtering
Malicious and forged requests are rejected at the edge, before the application runs.
Threat intelligence
Traffic from known malicious networks is blocked using continuously updated threat feeds.
Bot management
Multi-signal verification on desktop and mobile checks that every browser is consistent with its device and network. Search engine and AI crawlers are verified, and impostors are stopped.
Proxy and anonymity control
Visitors coming through Tor, VPN and hosting networks, or browsers that give away a rented proxy, must pass a human check before they see the site.
Web application firewall
Every request, including headers and API bodies, is inspected for injection, cross-site scripting and other OWASP Top 10 attacks. Encoded and obfuscated payloads are unpacked first, so evasion tricks fail.
Scan and anomaly detection
Probes for admin tools, secret files, backups and known exploits are blocked on sight. Decoys expose crawlers that ignore the rules.
Account protection
Brute-force and credential stuffing attempts are throttled and locked out. Two-step login protects accounts on the site and in the launcher, and is required for staff.
Data leak prevention
Outgoing responses are inspected so secrets and internal details never leave the server.
Server hardening
Sensitive files are unreachable from the web, and uploaded content can never execute on the server.
Spam and fraud protection
Reviews, tickets and listings are screened for spam and automated submissions. Orders and rewards are checked so they cannot be abused.
Flood protection and monitoring
Application-layer floods trigger an automatic lockdown. Every security event is logged in detail and delivered to the team in real time.
Abuse reporting
Confirmed attackers, spammers and fraudulent orders are reported to global abuse databases, each with its category and evidence.
Good bots in, fake bots out
Search engines and AI assistants are let through only after we confirm they come from their real owner. Anyone can copy a bot's name, nobody can copy its network.
- Googlebot
- Googlebot smartphone
- Google-InspectionTool
- Googlebot-Image
- Bingbot
- Applebot
- DuckDuckBot
- GPTBot
- OAI-SearchBot
- ChatGPT-User
- ClaudeBot
- Claude-User
- PerplexityBot
- MistralAI-User
A "Googlebot" coming from a rented server is blocked.
Tested against real attacks
These are the results of our last full review.
Reviewed
- 1,260
- attack payloads sent to 7 different entry points. All were blocked.
- 0
- false blocks across 631 normal reviews, comments and messages.
- 14
- search engine and AI crawlers tested. All got through, fake ones did not.
What an abuse report looks like
When an attacker is confirmed, the evidence goes to AbuseIPDB and Spamhaus so other sites can block them too. This example uses a documentation address.
IP 203.0.113.47 · Web App Attack, SQL Injection, Hacking Blocked 14 requests in 3 minutes by RexOS Shield (web application firewall) GET /search?q=1%27%20UNION%20SELECT%20password%20FROM%20users-- GET /.env · GET /wp-config.php.bak · GET /admin/phpinfo.php User agent: python-requests/2.31 · Network: hosting provider
How accounts and data are kept safe
Protection does not stop at the firewall. These rules are built into the site itself.
Passwords
Stored only as strong one-way hashes. Nobody can read them, including us.
Two-step login
On the site and in the launcher, and required for staff.
Sessions
Cookies are HttpOnly, secure and same-site, so scripts and other sites cannot use them.
Forms
Every form carries a one-time token, so other sites cannot submit it for you.
Database
Every query is prepared, so input can never become a command.
Browser rules
HSTS, Content Security Policy, frame and referrer rules on every page.
Uploads
Images and files can never run as code on the server.
Launcher
Open source and built in public by GitHub Actions.
How we set it up for you
Tell us what you run
Your site, server, store or panel, and the attacks you have seen.
We study your traffic
We learn what is normal for you, so real players are never blocked.
Shield goes live
Protection is switched on step by step, with logs from the first minute.
We keep watching
Alerts, monthly reports and help when an attack starts.
Want the same protection for your server or website?
We set up RexOS Shield for Minecraft networks, stores and community sites. Tell us what you run and we will reply with a plan.
- Firewall and bot protection tuned to your traffic
- Search engines and real players are never blocked
- Attackers reported with evidence
- Detailed logs and real-time alerts
- Help while an attack is happening
Questions
Will protection slow the site down?
No. Most checks run before the page is built, so a normal visit is not slower.
Can it block Google or real players?
Verified search engine and AI crawlers are always let through, and normal visitors pass without noticing.
What happens to attackers?
They are blocked and logged, and once confirmed they are reported to AbuseIPDB and Spamhaus with evidence.
Can I get this protection for my own server or website?
Yes. We set up RexOS Shield for Minecraft networks, stores and community sites. Contact us and tell us what you run.
Does it stop DDoS attacks?
It stops floods aimed at the website itself, such as request bursts and login floods. Very large network floods have to be absorbed by the hosting network, and we help you set that up.
What is the difference from a normal firewall plugin?
Shield runs before the site does, unpacks disguised attacks, checks bots against their real owners and shares confirmed attackers with abuse databases.
How do I report a security issue?
Open a support ticket and start the subject with Security. We reply quickly and credit responsible reports.
Found a security issue?
We welcome reports from researchers and players, and we credit responsible ones.
Please do
- Open a support ticket and start the subject with Security
- Include the steps to reproduce it
- Give us time to fix it before you make it public
Please do not
- Access or change other people's data
- Run floods or load tests
- Use automated scanners at high speed
If you do, the activity is logged and traced to the network it came from. We may report it with the evidence to that provider and to abuse databases; the provider can identify the account holder behind the address. Serious cases may be reported directly to the competent authorities, and you are responsible for the legal consequences.
Attacks like these are crimes. In the US, the Computer Fraud and Abuse Act (18 U.S.C. § 1030) allows up to 10 years in prison for damaging a computer system on a first offence, plus fines of up to $250,000. In the UK, the Computer Misuse Act 1990 allows up to 2 years for unauthorised access and up to 10 years for impairing a system.
