Web application firewall

The Keep

The Keep evaluates managed and custom WAF rules for SQL injection, XSS, protocol abuse, and your own signatures. Every workspace gets a hardened baseline as soon as you add a hostname. This is a Cloudflare Cloudflare WAF alternative included on every Zipper plan.

Cloudflare analogue: Cloudflare WAF

What it is

The Keep evaluates managed and custom WAF rules for SQL injection, XSS, protocol abuse, and your own signatures. Every workspace gets a hardened baseline as soon as you add a hostname.

Cloudflare analogue: Cloudflare WAF. SLA 99.99% · p99 8ms. Operators write custom rules. Admins publish managed packs.

▸OWASP baseline
▸Custom rule groups
▸Bot score hints
▸Challenge or block actions

How it works

Every proxied request is scored by managed OWASP, protocol, and CVE packs before it reaches origin.

Custom rules use a short expression language: path, method, IP, rate, and body snippets.

Actions: allow, log, challenge (via Portcullis), or block. Starter+ can group rules (auth, allowlist, bots).

Use cases

Concrete ways teams use this service on day one.

Stop admin scanning

Bots hammer /wp-admin and /phpmyadmin on a site that is not WordPress.

Add a custom rule: http.request.uri.path contains "/wp-admin" → block.
Leave it in log for ten minutes, then switch to block.
Watchtower shows the drop in 403s.

Protect a login form

Credential stuffing against /login.

Add a Keep rule: path eq "/login" and rate(1m) gt 40 → challenge.
Portcullis issues a token. Siteverify on the origin rejects replays.
Pair with a Scepter quota on POST /login.

Set it up in the dashboard

Dashboard → Services → The Keep.

Leave managed OWASP on. Add a custom rule with a group name on Starter+.

API

Control-plane: GET|POST|DELETE /api/v1/keep/rules. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

Create a custom rule

curl -sS -X POST https://tinyzipper.com/api/v1/keep/rules \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"Block wp-admin","expression":"http.request.uri.path contains \"/wp-admin\"","action":"block","rule_group":"scanners"}'

List the same resource in JavaScript

const res = await fetch("https://tinyzipper.com/api/v1/keep/rules", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Free includes 5 custom rules in the default group. Named groups need Starter.

Expressions are evaluated at the edge; they never run on origin.

▸SOC 2
▸OWASP ASVS
▸PCI-ready

Runbook

Set rules to log-only before a release, then turn blocking back on. Portcullis handles challenges.

Next: Portcullis · All docs · Create a free account