Choose the integration that fits your infrastructure
Ta treść nie jest jeszcze dostępna w Twoim języku.
The connector is what sees each request and applies your rules. Whichever you pick, the rules, the reports and the dashboard are the same, and you can change your mind later: the site keeps its settings. The connector only accepts rules signed for your account, and it tells your app what it saw through Qlyne-* headers.
The four ways to connect
Section titled “The four ways to connect”| You have | Pick | Install | What it covers |
|---|---|---|---|
| Shared hosting, or nowhere to run anything | Hosted by Qlyne | Point your DNS to Qlyne (2 min) | Everything, HTTPS included; traffic passes through Qlyne |
| A domain on Cloudflare | Cloudflare Worker | Deploy the Worker from the dashboard (5 min) | Almost everything (details on the Worker page); runs on Cloudflare’s edge, and knows each visitor’s country |
| A Next.js app on Vercel or elsewhere | Next.js middleware | One file and one secret (5 min) | What does not depend on the app’s response; see the page for the list |
| Your own server | Qlyne proxy | One container in front of the app (5 min) | Everything |
Your web server asks Qlyne
Section titled “Your web server asks Qlyne”If you already run NGINX, Traefik or Caddy, they stay where they are. The Qlyne proxy runs beside them in decision mode and your web server asks it, by sub-request, what to do with each request: pass it to the app with the Qlyne-* headers, show the challenge, block, send to the waiting room or apply the limit. About ten lines of configuration, ready to paste in Integration recipes.
| Your web server | Status |
|---|---|
| NGINX (also OpenResty, Nginx Proxy Manager and ingress-nginx on Kubernetes) | Available |
| Traefik v3 | Available |
| Caddy 2 | Available |
| Dokploy, Coolify (Traefik underneath) | Available |
| Envoy | Coming soon |
In this mode the sub-request carries neither the request body nor the app’s response, so some things stay with the proxy in front: the WAF only inspects path and query, forms are not stamped, an access gate locks but cannot be opened with the password or the email, and the consent banner, the security headers and the page cache do not apply. Challenge, IP and country rules, Tor, reputation, AI crawlers, impostors, traps, rate limits, waiting room and your own rules all work, and the bot score only comes from a cookie already there.
JavaScript tag
Section titled “JavaScript tag”Coming soon: one line of script in your pages that scores each visitor and feeds the dashboard, with nothing to install on the server. On its own it observes; with the proxy or decision mode it turns the score into action.
Not sure? Start with the one you can set up today and read Get started.