Feature — Security

Gateway-Level Security Without the Complexity

Enforce CORS, IP restrictions, bot detection, and TLS at the gateway — before requests reach your services. WAF-compatible and OWASP-aware by design.

Defense at the Perimeter

apiRuler applies security policies before traffic reaches your backend. Combine with your existing WAF for layered defense — apiRuler handles API-level controls, WAF handles network-level threats.

  • CORS — Configurable cross-origin policies per route and service
  • IP Restriction — Allow/block lists at service or route level, with CIDR support
  • Bot Detection — Fingerprint-based bot filtering to block automated traffic
  • Let’s Encrypt — Automatic TLS certificate provisioning and renewal
  • SNI / TLS — Multi-domain TLS with SNI routing and centralized certificate management
API security and authentication

WAF-Compatible. OWASP-Aware.

apiRuler is designed to operate behind a WAF. The WAF handles L3-L7 network threats (DDoS, SQLi, XSS). apiRuler handles API-layer controls — auth, rate limiting, routing, and application-level filtering. Two layers, zero overlap.

Network Layer (WAF)

DDoS protection, SQLi/XSS filtering, L3-L7 threat mitigation — handled by your WAF.

Combined Defense

apiRuler + WAF = complete security stack. Each layer handles what it does best.

API Layer (apiRuler)

Auth, rate limiting, CORS, IP restrictions, bot detection — API-specific security at the gateway.

Secure Your API Layer Today

Deploy gateway-level security without touching your backend services.