Web application firewall
The Keep
The Keep looks at HTTP requests on Zipper. It blocks common attacks (SQL injection, script tricks, odd protocols) and your own rules. Your origin only sees what passes. This is an application-layer WAF, not a packet filter. This is a Cloudflare Cloudflare WAF alternative included on every Zipper plan.
Cloudflare analogue: Cloudflare WAF
What it is
The Keep looks at HTTP requests on Zipper. It blocks common attacks (SQL injection, script tricks, odd protocols) and your own rules. Your origin only sees what passes. This is an application-layer WAF, not a packet filter.
Cloudflare analogue: Cloudflare WAF. SLA 99.99% · p99 8ms. Operators write custom rules. Admins publish managed packs.
- ▸Common-attack rules on
- ▸Your own rules
- ▸Bot hints
- ▸Challenge or block
How it works
Every proxied request is scored by managed OWASP, protocol, and CVE packs before it reaches origin.
Custom rules use a short expression language: path, method, IP, rate, and body snippets.
Actions: allow, log, challenge (via Portcullis), or block. Starter+ can group rules (auth, allowlist, bots).
Use cases
Concrete ways teams use this service on day one.
Stop admin scanning
Bots hammer /wp-admin and /phpmyadmin on a site that is not WordPress.
- Add a custom rule: http.request.uri.path contains "/wp-admin" → block.
- Leave it in log for ten minutes, then switch to block.
- Watchtower shows the drop in 403s.
Protect a login form
Credential stuffing against /login.
- Add a Keep rule: path eq "/login" and rate(1m) gt 40 → challenge.
- Portcullis issues a token. Siteverify on the origin rejects replays.
- Pair with a Scepter quota on POST /login.
Set it up in the dashboard
Dashboard → Services → The Keep.
Leave managed OWASP on. Add a custom rule with a group name on Starter+.
API
Control-plane: GET|POST|DELETE /api/v1/keep/rules. Send Authorization: Bearer tz_live_YOUR_TOKEN.
Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.
Create a custom rule
curl -sS -X POST https://tinyzipper.com/api/v1/keep/rules \
-H "Authorization: Bearer tz_live_YOUR_TOKEN" \
-H "Idempotency-Key: $(uuidgen)" \
-H "Content-Type: application/json" \
-d '{"name":"Block wp-admin","expression":"http.request.uri.path contains \"/wp-admin\"","action":"block","rule_group":"scanners"}'List the same resource in JavaScript
const res = await fetch("https://tinyzipper.com/api/v1/keep/rules", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
"Content-Type": "application/json"
}
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);Tips
Free includes 5 custom rules in the default group. Named groups need Starter.
Expressions are evaluated at the edge; they never run on origin.
- ▸SOC 2
- ▸OWASP ASVS
- ▸PCI-ready
Runbook
Set rules to log-only before a release, then turn blocking back on. Portcullis handles challenges.
Next: Portcullis · All docs · Create a free account