OpenWAF is a web application firewall and authoritative DNS service run from the EU. You put a site behind the OpenWAF edge by proxying its DNS records: visitors reach the edge nodes, which terminate TLS, apply the site's rules and forward allowed requests to your origin server. Every change to the configuration is versioned, needs a reason and can be rolled back.
These pages cover what every account shares: signing up, organizations and roles, zones and names, API tokens, agency features and the limits of the service.
Get started
Create an accountSign up at dash.openwaf.dev with an email code, Google or GitHub.Organizations, members and rolesWho can do what, and how the effective role of a session or token is computed.Add your first siteAdd a domain, point it to OpenWAF and protect its first site end to end.Proxied and DNS-only recordsDecide which names go through the edge and which only resolve.
Concepts
How OpenWAF worksThe path of a request from the nameservers to your origin.Zones, names and sitesThe vocabulary used across the dashboard, API, CLI and MCP server.API tokensRoles, scopes, expiry and how tokens are checked on every request.
For agencies and teams
Agencies and clientsGroup domains by end client and give each client limited access.White-label dashboardYour brand, your dashboard domain and your own nameservers.Team membersInvite people, change roles and remove access.