PLATFORM / HOW IT WORKS

How it works

CrownWall is a complete application delivery platform — routing, inspection, and protection run in the same pipeline, because they were always the same job.

One engine for delivery and security

One ordered edge pipeline.

Client → TLS Termination → Bot Check → WAF Inspection → Rate Limit → Load Balance → Backend Origin

Shared

context

One

Request ID

Unified

logging

Security bolted on is security with gaps

Most teams arrive having assembled a stack: a cloud load balancer here, a WAF plugin there, bot management on top, compliance reporting pulling from three log sources. Each product sees a fragment of traffic. None sees the whole picture. The gaps between them are where attacks succeed.

Single pipeline

Context

Shared — bot classification, reputation labels, and rate-limit state visible to every rule.

Rules

Coordinated — managed WAF, bot control, DDoS limits, and custom policy in one Web ACL.

Logs

Correlated — one Request ID from edge to origin, JSONL access logs, Prometheus metrics.

What happens to every request

Every request follows the same ordered path through the CrownWall edge.

1. TLS termination

The connection terminates at the edge using your certificate — bring your own or use one issued for your domain. HTTP/1.1 and HTTP/2 are supported; HTTPS redirect is enforced so credentials never travel in cleartext. Multiple hostnames on one listener via SNI.

2. Protocol normalisation

The request is parsed and normalised before rule evaluation. Encoded and obfuscated attacks — double URL encoding, null bytes, and case variants — are transformed so inspection cannot be bypassed by encoding tricks.

3. IP reputation & geo checks

Fast lookup against managed IP reputation data and custom CIDR block lists. Suspicious hosting ranges, scraper networks, and automation-friendly IP space receive labels for downstream block, challenge, or captcha decisions.

4. Bot identification

Managed bot control classifies search engines, LLM agents, scanners, CLI tools, headless browsers, scrapers, and more. Suspicious clients may receive browser challenge or self-hosted ALTCHA proof-of-work captcha with a time-limited session token.

5. WAF rule evaluation

Managed OWASP Top 10 rule groups and custom rules evaluate the full request, referencing bot labels, reputation signals, headers, path, body, and method. Request and response stages run separately; rules can allow, block, count, challenge, or captcha.

6. Rate limit & DDoS checks

Granular Layer 7 rate limits evaluate client IP, IP + path, query string, and composite keys. Exceeded limits trigger block, challenge, or captcha — shedding application-layer floods at the edge so you pay for clean traffic, not malicious volume.

7. Routing & cache decision

A healthy backend is selected using round-robin, hash-based stickiness, weighted, or least-connections routing. HTTP, HTTPS, TCP, or gRPC health checks remove failed origins. GET/HEAD responses can be served from edge cache when configured.

8. Origin forward & observability

Requests are forwarded with accurate client IP, host, and protocol headers. A unique Request ID appears on the response, in origin requests, structured JSONL access logs, live dashboard, and Prometheus metrics. Policy changes take effect on reload without app redeploys.

Fast by design

Each layer runs in single-digit milliseconds. The full pipeline typically adds minimal latency to request time. For cached responses, the origin is not contacted at all.

Live in four steps

A simple deployment path from adding your domain to live, protected traffic.

Step 1 — Add your domain

Register the hostname(s) you want to protect and accelerate. CrownWall provisions TLS, routing, and a default security posture. Capabilities enabled: per-domain Web ACL, HTTPS termination, Request ID on every transaction.

Step 2 — Configure your origins

Point at fixed origin servers or a DNS hostname for dynamic discovery. Set up health checks across multiple backends; CrownWall load-balances only to healthy nodes. Capabilities enabled: load balancing, health monitoring, trusted forwarding headers, optional edge caching per path.

Step 3 — Apply your security policy

Managed WAF rule packs, bot control, IP reputation, and rate limits are available from day one. Layer custom rules for API keys, admin path blocks, and geo policies. Test new rules in observe-only mode before enforcing.

Step 4 — Point your DNS

Update DNS to route traffic through CrownWall. Protection and delivery go live within minutes of propagation — no appliances, no professional services, no weeks of onboarding. Capabilities enabled: full inline pipeline with correlated logging from the first request.

What you get from day one

Start with managed defaults, then refine rules as your traffic data arrives.

Web application firewall

OWASP Top 10 managed packs, custom rules, request/response inspection.

Bot management

Managed bot control, challenge & proof-of-work captcha.

DDoS protection

L7 rate limits, managed IP reputation, policy chaining.

Load balancing

Health checks, dynamic DNS origins, edge caching.

API security

Per-endpoint rate limits, composite keys, upstream signals.

Observability

Live dashboard, JSONL logs, Prometheus export, Request ID.