Application firewall
Blocks SQL injection, XSS, path traversal, command and code injection, attack tools and probes for sensitive files before your code runs.
Zero Point Cyber Security
Enterprise-grade protection for every website and server you run.
An application firewall with a self-hosted CAPTCHA, country rules and global IP lists, plus malware scanning and server audits, all watched from one Control Center. Install with one command, a WordPress plugin or a Composer package. Nothing is uploaded by hand.
See services and plans Live status
- Self-hosted CAPTCHA
- Automatic blocking
- WordPress 2FA
- Uptime monitoring
- Signed releases
0servers protected
0sites protected
0attacks seen in the last 24 hours
Features
What it does
Self-hosted CAPTCHA
Doubtful requests get a CAPTCHA instead of a hard block. No Google, no tracking, no JavaScript; Persian digits work too.
Country rules and IP lists
Block or challenge whole countries and Tor, and push global block and allow lists to every server in minutes.
Malware scanner
Finds web shells, backdoors, packed code and PHP hiding in upload folders. It never deletes anything for you.
WordPress hardening
Two-factor login (TOTP), login CAPTCHA, alerts when an administrator logs in from a new place, login throttling, XML-RPC and user-enumeration blocking, upload guard and virtual patches for known plugin flaws.
Control Center
Threat level, live events, top attackers and countries, a filterable log viewer, IP investigation and printable reports.
Integrity monitor
Signed file baselines show exactly which files were added, changed or removed.
Server audit
Checks PHP settings, leftover installers, exposed .env and backup files, world-writable files and SSH configuration.
Automatic blocking
An IP that attacks one site is blocked on every server within minutes; IPs attacking several sites get a longer, reputation-based block.
Uptime, SSL and domain monitoring
Every licensed domain is checked every few minutes, with alerts when it goes down and before its certificate or domain registration expires.
Weekly reports and Telegram actions
A weekly e-mail summary for you and for each customer, and Telegram alerts with buttons to block or unblock an IP.
Safe by design
Fails open, never logs passwords or request bodies, signed releases with automatic rollback, starts in monitor mode.
Architecture
Every request passes six layers
Checks run in order inside PHP, before your application. The first layer that decides wins, and every decision is logged to the console.
- 1IP listsGlobal allow and block lists, pushed from the console.
- 2Country rulesBlock or challenge countries and Tor (behind Cloudflare).
- 3Rate limit and bansPer-IP limits and temporary bans for repeat offenders.
- 4Attack tools and probesScanner user agents and requests for .env, .git, backups.
- 5Content rulesSQLi, XSS, traversal, command and code injection, CRLF, scored.
- 6CAPTCHA challengeDoubtful requests must prove they are human.
Console
A Control Center your team will actually open
Inspired by the best network firewalls: one screen for the threat level, live events and the health of every server.
- Threat level gauge and 24-hour activity
- Log viewer with filters and CSV export
- IP investigation with one-click block
- Protection profiles: relaxed, balanced, strict
- Printable 7 and 30 day reports
- Roles: owner and read-only viewer
Services
Choose how you connect
Four service types, each with its own installation. Nothing is uploaded by hand.
Virtual server
Limited by servers, domains and server structure
One command as root. Works with cPanel, DirectAdmin and plain Linux.
Dedicated server
Limited by servers, domains, structure and virtual machines
The same command on the host and on each virtual machine.
WordPress
Limited by domains
Install the plugin from wp-admin or with one WP-CLI command.
Custom software
Limited by domains
Connect your own application through the open API.
How it works
- 1
Get a license
We create a license for your service type with the number of servers and domains you need.
- 2
Install
Paste one command, install the plugin, or call the API. The server appears in the console in under a minute.
- 3
Watch, then block
Start in monitor mode, review what would have been blocked, then switch sites to blocking with one click.
Honest limits
Zero Point is defence in depth at the application edge. It does not replace patching, backups, parameterised queries, a network firewall or a penetration test. Pattern-based detection can have false positives, which is why every site starts in monitor mode.
Questions
Does it slow my site down?
The shield runs inside PHP before your application and does simple pattern checks. Reports are sent in batches by a scheduled job, so your visitors never wait for the console.
What if the console is unreachable?
Protection keeps working locally and reports are queued. Nothing is switched off.
Can it delete my files?
No. Zero Point is read-only by design: it reports and blocks requests, it never edits or deletes your files.
How do updates work?
Releases are signed. Servers verify the signature against a key they already hold before switching, and roll back automatically if the new release fails its check.
Ready to protect your sites?
Licenses are issued per customer for servers, WordPress or custom software.