The WAF that blocks attacks, not your customers.
Protects from the first request, explains every block, and shows your customers it's working.
$ curl -s https://www.pyxsoft.com/install-pxshield | bashNo credit card needed. For Apache, nginx and Caddy, on cPanel, DirectAdmin or no panel at all.
attacks blocked
Bots tried to read this server's .env file 16,397 times. Every attempt was blocked.
Why hosting providers run it
Protection that works on its own, and that you and your customers can actually see.
Blocks before your web server sees it
SQL injection, XSS, WordPress brute force, web shell uploads, stolen .env files, backups and .git folders, and layer 7 floods with a browser challenge. Blocked requests never reach Apache, nginx or Caddy.
Protects from day one
There is no learning mode. Managed rules protect every domain from the first request and update themselves. Proven in production on thousands of cPanel accounts.
Explains every block
Open any blocked request and read why it was stopped, in plain English. If a legitimate request was caught, add an exception for that URL, domain or address in one click.
Your customers see it working
Every cPanel account gets its own pxShield page with the attacks stopped on its sites. Your customers see what they pay for, and your support team gets fewer tickets.
Your server, your traffic
pxShield runs on your own server. No DNS changes, no cloud, no traffic leaving the machine. It also works behind Cloudflare, keeping the real visitor address in your logs.
What your customers see
Each cPanel account gets a pxShield page for its own domains. When something is blocked, it says what happened and why, in plain English.
- 14:02GET /.envReading .env secrets
- 13:58POST /wp-login.phpWordPress brute force
- 13:51GET /.git/config.git folders
- 13:47GET /backup.sqlDatabase dumps
- 13:40POST /wp-content/uploads/x.phpWeb shell upload
Someone tried to download your .env file
This file usually holds your database password and API keys. pxShield refused the request before it reached your website, so nothing was exposed.
If this was you or a service you trust, you can allow it.
Example data. The page is available in English and Spanish and finds every domain on the account by itself.
How it fits on your server
pxShield is a security layer that runs on your own server. It checks each request and hands only clean traffic to your web server.
- Visitor or botAny request to one of your sites
- pxShieldChecks rules, reputation and uploads. Attacks stop here.
- Your web serverApache, nginx or Caddy, receiving only clean traffic
- Your sitesWordPress, Laravel, PrestaShop or any other application
Updated automatically, no rule files to edit.
A browser challenge for suspicious clients.
Block or allow whole countries, per domain.
Write your own on top of the managed set.
Created from the UI or straight from a blocked event.
Login, XML-RPC and sensitive endpoints.
Web shells and scripts stopped at upload time.
Allow and block lists for every site.
30 days of history in WHM and in each cPanel account.
Already infected before you installed it?
pxShield keeps new attacks out. Pyxsoft Anti Malware finds what is already on disk and cleans it. Pyxsoft Suite gives you both under one license, for a little more than pxShield alone. See the price in your currency.
One price per server. Every feature included.
Unlimited sites and accounts, and a 7-day free trial without a credit card. Prices come straight from our checkout, in your currency.
Finds and cleans malware on every account, in real time and on demand.
Anti Malware and pxShield under one license code.
The WAF for Apache, nginx and Caddy, with a dashboard for every customer.
Using CorePanel? pxShield is already included.
Prices for your location. Taxes are calculated at checkout by Paddle, our merchant of record.
More than 50 servers? Talk to sales
Questions
More in the pxShield documentation and the installation guide, for cPanel, DirectAdmin or no panel.
Do I need to change DNS or send traffic anywhere?
No. pxShield runs on the same server as your websites. DNS stays as it is and no traffic leaves the machine.
What about false positives?
Every block is listed with its reason, so a wrong block is easy to spot. You can turn off one rule for one URL, domain, method or address without lowering protection for everyone else, from WHM or straight from the blocked event.
Does it work behind Cloudflare?
Yes. Tell pxShield to trust the Cloudflare addresses and it reads the real visitor address, so blocks, reputation and your web server logs show the right IP.
Can I use it without cPanel?
Yes. On DirectAdmin it has its own plugin and works with Apache, nginx, LiteSpeed and OpenLiteSpeed. On Debian and RHEL-based servers with no panel, pxShield works with Apache, nginx or Caddy. The guide explains how to put it in front of your web server.
Will it slow my server down?
pxShield is built to filter each request in a fraction of a millisecond. Because attacks are dropped before your web server sees them, Apache, nginx or Caddy spend no time on them.
What do my customers see?
A pxShield page inside cPanel for each of their domains: attacks blocked, the most common attack types and addresses, and a plain-English explanation of any block. It is available in English and Spanish.
I use CorePanel. Do I need it?
No. CorePanel already includes pxShield, built into its web server. There is nothing to install or buy.
Does it include the malware scanner?
No. pxShield keeps attacks out; Pyxsoft Anti Malware finds what is already on disk. Get both with Pyxsoft Suite.