Multi-layered security
Two layers of defence. Every request is scanned at the edge before it reaches your site, and anything malicious is blocked instantly. A server-level firewall then adds protection against brute force, exploits and more.
Free with every plan
Instant protection with a free WAF
Our enterprise-level Web Application Firewall blocks malicious traffic before it reaches your site — automatically, at the edge, with no plug-ins and no code changes.
- Automatically blocks suspicious traffic
- Fully integrated — no plugins required
- 100% free for all HDI customers
- Protects against OWASP Top 10 attacks
How we protect your website from attacks and data breaches
Our custom-built, enterprise-level WAF is included at no extra cost. It protects every website on the platform against cross-site scripting, SQL injection, suspicious traffic and more.
Pre-configured for maximum protection
Optimised firewall rules are applied out of the box, tuned to detect the latest threats — including OWASP Top 10 attacks such as XSS and SQLi. Nothing to configure.
Optimised for speed
The WAF runs at the very edge of the network, intercepting requests before your website code. Because it isn’t a plugin inside your site, pages load faster and protection is instant.
Expert bot detection
Malicious bots are intercepted so only legitimate interactions get through — safeguarding your site from unauthorised crawling, content theft and spam submissions.
Threat coverage
Blocked at the edge, before your code runs
Every HTTP request is inspected for known attack patterns and anomalies, then answered according to pre-defined and custom rules maintained by our security team.
The firewall behaves like a security guard: the right traffic goes in, anything malicious is turned away. It sits in front of the site, so it protects even when a plugin or theme would otherwise be vulnerable.
SQL injectionCross-site scriptingPath traversalTrojans
Bad botsBrute forceDDoSSpam submissionsContent scrapers
1
Visitor requestAny HTTP request, any method
2
Edge WAF inspectionRules evaluated in milliseconds
3
Allow or blockClean traffic continues, threats stop here
4
Your websitePlus server-level firewall and malware scanning
No code changes requiredZero added latency
Enterprise-level security, included
Our free WAF is your first line of defence against criminals targeting your site’s data — and it works alongside the rest of the stack.
Compliance requirements
A WAF shows you take security seriously and helps meet requirements such as PCI. It also reassures clients that their data is protected.
Layered security
Powerful alone, stronger together: the WAF works alongside DDoS protection, brute-force login protection, malware scanning and two-factor authentication.
Free and integrated
Unlike hosts that charge extra to secure your site, the WAF is free on every plan and works straight out of the box.
Regular updates
Our security team continually updates the ruleset from commercial feeds and custom rules, so new threats are covered without you lifting a finger.
How it works
On by default. Nothing to install.
WAF protection is part of the platform, so every site you add is covered the moment it goes live — including sites you build and manage for clients.
Whether you migrate a site or launch a new one, it inherits the platform’s edge configuration automatically. No DNS changes beyond pointing the domain at us.
Requests are matched against OWASP-style signatures, bot heuristics and custom rules at the edge. Clean traffic passes straight through; attacks are terminated before your application sees them.
Blocked requests, top threat types and traffic sources are visible in SiteCP, alongside the CDN report suite — so you can spot an attack trend without reading logs.
Block specific IPs or whole geographies, and add rules for your own application’s quirks — useful for agencies running many different stacks.
Choose your hosting plan
Enjoy the benefits of the free WAF with any of these hosting packages.
Unlimited Hosting
Unlimited storage, unmetered bandwidth and up to 20 hosted accounts on one plan.
₹100/month
View hosting plans →
Lifetime Hosting
Host 3 websites for life with a single payment — no renewals, ever.
₹2,999one-time
View lifetime plans →
UH Ultimate Cloud
Unlimited websites, storage, databases and email for one yearly price.
₹3,500/year
View unlimited plan →
Security questions
If you’re unsure whether your site is covered, ask us — we can check it in seconds.
What is a Web Application Firewall?
A WAF protects web applications from attacks that exploit vulnerabilities. The HDI WAF inspects every HTTP request for SQL injection, trojans, cross-site scripting, path traversal and many other attack types, then responds based on pre-defined and custom rules maintained by our security team. In simple terms, it’s a security guard: the right traffic is allowed in, anything malicious is turned away.
How do I use the HDI WAF?
You don’t have to do anything. If you host with HDI you automatically benefit from the firewall, alongside every other security feature on the platform.
Other hosts charge for WAF — why is it free here?
All our platforms are built with a security-first approach, and we give customers the tools they need to stay safe. Security isn’t an upsell.
Does the WAF cover every site I host?
Yes. The security suite is enforced at the platform level, so every website you add is protected automatically — no per-site setup.
My website is new. Do I need a firewall?
Yes. Bots constantly scan the internet for new domain names, looking for sites that haven’t set up security yet. Being new makes you a target, not a non-target.
Will the WAF block legitimate traffic?
Rules are tuned to minimise false positives, and you can allow specific IPs or adjust rules if a legitimate integration is being caught. Our team can help you tune it.
Security that’s already switched on
Every HDI plan includes the WAF, DDoS protection, malware scanning, 2FA and free SSL — no add-on required.