# WebUpCheck Protect
Authenticated behavioral website and API protection. DNS-only onboarding needs no plugin or separate origin hostname; origin lockdown is optional and direct hosting access may remain possible. Ownership, HTTPS, hosting and routing checks still apply. POST /api/dns/connect saves the current hosting destination before cutover; POST /api/domains/{id}/prepare-dns prepares Observe forwarding with explicit scope acknowledgement. Existing guarded gateways are preserved. Register and create a private scoped key in the dashboard.
- Website support: verified subdomains including www; root/apex domains only through CNAME flattening or ALIAS at the root DNS provider (dashboard setting apexDnsMode cname_flattening), never static IPs or A records. Each hostname covers only itself (a root does not cover www). WordPress origins: see https://app.webupcheck.com/agents.html#wordpress. Sites already on Cloudflare can instead use the Cloudflare connector (a Worker in their own zone; DNS and origin unchanged; decisions from request metadata only; origin protection owner-attested): see https://app.webupcheck.com/agents.html#cloudflare-connector. Explicit route profile website: Free120requests/10s,600/min,200distinct nonasset paths/min,12missing-path responses; omitted profile keeps API30/120/40 and4missing-path responses. Assets still count toward request budgets and history. Transport depends on the route profile. Website routes: GET/HEAD/POST/PUT/PATCH/DELETE/OPTIONS; uncompressed JSON, standard forms, multipart and binary bodies up to10MiB (over1MiB must declare Content-Length); streamed responses25MiB;30-second deadline. API routes (default) and paths outside configured routes: GET/HEAD/POST/OPTIONS; POST must be JSON, up to64KiB; responses1MiB;10-second deadline. A REST API that needs PUT/PATCH/DELETE or larger/binary bodies can set profile website on its route; JSON-only then no longer forces a browser CORS preflight, so cookie-authenticated APIs must check a CSRF token or Origin themselves. Origin cookies and redirects mapped to protected hostname. Oversized unknown-length responses terminate. No WebSocket/SSE/long-running streams/upload malware scanning. Lockdown excludes anonymous website visitors too. Read current domain.boundary and policy before changes.
- Landing: https://webupcheck.com/protect
- Emergency guide: https://webupcheck.com/under-attack
- Register: https://app.webupcheck.com/register
- Guide: https://app.webupcheck.com/agents.html
- REST contract: https://app.webupcheck.com/openapi.json
- MCP endpoint: https://app.webupcheck.com/mcp (Streamable HTTP, POST). OAuth 2.1 with PKCE and dynamic client registration: https://app.webupcheck.com/.well-known/oauth-protected-resource/mcp. Private Bearer keys also work.
- Plans: Free (1 hostname), Protect US$49/month (1), Scale US$199/month (5), Enterprise by contract (25). With several hostnames, call list_hostnames and pass domainId.
- MCP tools: list_hostnames, get_protection, get_protection_events, set_protection_mode, release_caller, issue_traffic_credential, block_caller, set_route_limits, set_emergency_lockdown, set_trusted_agent_signers
- Registry manifest: https://app.webupcheck.com/server.json
Read status on Free. Protect permits management. Automatic restrictions start at60seconds and repeat violations escalate to5and15minutes; manual blocks last up to one hour. Repeated 401/403 responses count as failed authentication. Forty distinct normalized paths per caller in 60 seconds trigger enumeration detection by default (Protect distinctPaths:10–200). Query strings are excluded; path hashes expire with the caller window. Callers are classed as credential, signed_agent (verified Web Bot Auth from a trusted signer), automated or anonymous. A quiet event log does not establish no attacks. Read mode, coverage and history availability before acting.