Proxy Mode

When a DNS record is set to Proxied, all traffic flows through ShieldFlare before reaching your server. Visitors see the ShieldFlare IP instead of your real server IP, protecting it from direct attacks.

DNS-Only Mode

When set to DNS-Only, ShieldFlare resolves the domain to your real server IP. There is no proxy protection but DNS is still managed through ShieldFlare.

WAF Rules

The Web Application Firewall inspects every HTTP request for known attack patterns including SQL injection, Cross-Site Scripting (XSS), path traversal and bot signatures.

IP Guard

IP Guard uses a WireGuard VPN tunnel to protect your server. All incoming traffic passes through a dedicated ShieldFlare IP, which filters attacks before forwarding clean traffic to your server. Your real IP remains hidden at all times.

Dedicated IPs

Each IP Guard tunnel and Game Server gets a dedicated IP address from the ShieldFlare pool. This IP is exclusively used for your service and is never shared with other customers.

How it works

When proxy is enabled, all traffic to your domain flows through ShieldFlare first. We analyze the traffic, block attacks in real-time, and forward clean requests to your origin server. Visitors never see your real IP.

Attack types blocked

Settings

Per domain you can configure:

• Proxy toggle — Enable/disable proxy per DNS record
• WAF — Web Application Firewall rules
• Geo-blocking — Block traffic from specific countries
• Bot protection — Challenge page for automated traffic
• SSL — Free Let's Encrypt certificates

Supported record types

Nameservers

ns1.shieldflare.nl  →  149.202.63.64
ns2.shieldflare.nl  →  51.38.13.157

Automatic renewal

SSL certificates are automatically renewed 30 days before expiry. You will receive a notification if renewal fails.

Requirements

• Proxy must be enabled for the domain
• Nameservers must point to ShieldFlare
• Domain must be active and resolving

SSL Monitor

View SSL status for all your domains under Domains → SSL tab. You will receive a push notification and email when a certificate expires within 14 days.

Built-in rules

Custom rules

Add custom WAF rules under Domains → WAF tab. Rules can be based on:

• IP address or CIDR range
• Country code
• User-Agent string
• URL pattern
• Request method

How it works

IP Guard creates an encrypted WireGuard tunnel between your server and ShieldFlare. All incoming traffic passes through your dedicated ShieldFlare IP, which filters attacks before forwarding clean traffic to your server via the tunnel. Your real IP is never exposed.

Setup

apt install wireguard -y

wg-quick up wg0
systemctl enable wg-quick@wg0

Firewall rules

ShieldFlare automatically configures iptables rules to only allow traffic through the tunnel. Default open ports:

TCP 80    — HTTP
TCP 443   — HTTPS
TCP 22    — SSH
UDP *     — All UDP traffic

Settings

Supported games

Failover

Configure a backup server under Game Servers → Settings → Failover. If the primary server becomes unreachable, ShieldFlare automatically switches to the backup within 30 seconds.

Minecraft MOTD

Customize the server description players see in the server list under Game Servers → Settings → Minecraft MOTD. Standard Minecraft color codes are supported:

§6§lMy Server §r§7| §fWelcome!

Setup

Email authentication

ShieldFlare automatically configures SPF, DKIM and DMARC records for your domain to prevent email spoofing and improve deliverability.

Traffic overview

View incoming traffic, blocked requests, bandwidth usage and attack statistics under Dashboard → Analytics. Data is collected every minute and shown in interactive charts.

Metrics available

• Total requests and bandwidth
• Blocked requests and attack rate
• Unique visitors and geographic distribution
• Response time and error rate
• Top blocked IPs

Attack reports

Detailed attack reports are automatically generated during an attack. You also receive a daily summary report at 08:00 AM via email if any attacks occurred in the past 24 hours.

How it works

ShieldFlare checks your domain via HTTP and HTTPS every 5 minutes. If a domain becomes unreachable, you receive an immediate notification. When the domain recovers, you receive a recovery notification.

Viewing uptime

View uptime history for any domain under Domains → Uptime tab. The 90-day uptime bar shows availability at a glance.

Notifications

When a domain goes offline you receive:

• Push notification in the browser
• Email notification
• Discord DM (if linked)

Notification types

Configure notifications

Manage notification preferences under Dashboard → Notifications. Link your Discord account under My Account to receive Discord DMs.

Base URL

https://shieldflare.nl/api

Format

All requests and responses use JSON. Include the Content-Type: application/json header with POST and PATCH requests.

Rate limiting

The API is limited to 100 requests per minute per API key. When exceeded, you receive a 429 Too Many Requests response.

HTTP status codes

Creating an API key

Go to Dashboard → API Keys → Create new key. Save the key immediately — it is only shown once.

Using the API key

Include the API key as a Bearer token in the Authorization header:

Authorization: Bearer sf_live_xxxxxxxxxxxxxxxxxxxx

Example request

curl https://shieldflare.nl/api/domains \
  -H "Authorization: Bearer sf_live_xxxxxxxxxxxxxxxxxxxx"

Example response

{
  "domain": {
    "id": "clx1234567890",
    "name": "example.com",
    "status": "ACTIVE",
    "proxied": true,
    "sslDaysLeft": 45,
    "createdAt": "2026-01-01T00:00:00.000Z"
  }
}

Create a record

curl -X POST https://shieldflare.nl/api/dns/DOMAIN_ID \
  -H "Authorization: Bearer sf_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "A",
    "name": "@",
    "content": "1.2.3.4",
    "ttl": 3600,
    "proxied": true
  }'

Requirements

• WHMCS 8.x
• PHP 8.1+
• ShieldFlare Reseller account
• ShieldFlare API key (reseller type)

Installation

How provisioning works

When a customer places an order in WHMCS:

1. WHMCS calls the ShieldFlare API with the customer's email and chosen plan
2. ShieldFlare creates a new account under your reseller profile
3. The customer receives a welcome email with login credentials
4. The customer appears in your reseller dashboard under Clients

Single Sign-On (SSO)

Customers can click Login to ShieldFlare in WHMCS to automatically log in to their ShieldFlare dashboard without entering a password.

Setup

Go to Dashboard → Webhooks → Create webhook and enter the URL you want to receive events at.

Events

Payload example

{
  "event": "attack.detected",
  "timestamp": "2026-09-12T12:00:00.000Z",
  "data": {
    "type": "SYN Flood",
    "count": 4329,
    "mitigated": true,
    "service": "5.135.43.126"
  }
}

Benefits

• ✅ 20% commission on every active client
• ✅ Full white-label — your own logo, company name and colors
• ✅ Client management dashboard
• ✅ Client impersonation — log in as any of your clients
• ✅ WHMCS module included
• ✅ Reseller API for custom integrations
• ✅ Custom domain for your client portal

Getting started

Contact us via support to apply for a reseller account. We will review your application within 24 hours.

White-label

Configure your white-label settings under Reseller → White-label:

• Company name — shown in the navigation and emails
• Logo URL — your company logo (PNG recommended)
• Primary color — brand color for the interface
• Support email — shown to your clients as support contact
• Custom domain — host the client portal on your own domain

Commission

You earn 20% commission on the monthly plan price of each active client. Commissions are calculated monthly and paid out when your balance reaches €50.

Create client example

curl -X POST https://shieldflare.nl/api/reseller/clients \
  -H "Authorization: Bearer sf_live_reseller_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "client@example.com",
    "name": "John Doe",
    "planSlug": "starter"
  }'