Edge
Your origin should never face the open internet
ArxLayer puts the edge in front of every exposed surface, so only the edge talks to your origin. Hide its address, lock down who can reach it, and shrink the attack surface to a single, controlled path.
The problem
An exposed origin is a bypass waiting to happen
If attackers can reach your origin directly, they walk right past every protection you put at the edge.
Direct-to-origin attacks
A leaked or scanned origin IP lets traffic skip the edge entirely, bypassing your WAF, rate limits, and bot defenses.
SSRF and forged destinations
Server-side request forgery and spoofed origins push traffic to endpoints you never meant to expose.
A sprawling attack surface
Every origin reachable from the internet is one more host to harden, patch, and watch.
What you get
One controlled path to your origin
Origin Protection collapses many exposed entry points into a single enforced route that only the edge can take.
Hide your origin
Traffic resolves to the edge, not your origin. Its real address stays out of public view.
Origin allowlisting
Define exactly which origins the edge may reach. Anything not on the list is refused.
Validated, pinned origins
Origins are validated and pinned, so requests can't be redirected to an attacker-chosen destination.
Edge-only ingress
Lock origin access to the edge so direct-to-origin traffic has nowhere to land.
Defeat SSRF reach
Pinned destinations and strict allowlisting stop forged or unexpected origin targets cold.
No keys at the edge
The enforcement layer holds no private keys, keeping a clean boundary between protection and custody.
How it works
Shield your origin in three steps
Route through the edge, allowlist your origins, then close the direct path.
Route through the edge
Point your domain at ArxLayer Edge. Traffic terminates there and is inspected before any origin call.
Allowlist and pin origins
Declare your valid origins. The edge validates and pins them so only approved destinations are ever reached.
Close direct access
Restrict your origin to accept the edge only. Now every request passes through your full protection stack.
FAQ
Questions, answered
- How does ArxLayer hide my origin?
- Your domain resolves to the edge instead of your origin, and only the edge connects to it. Lock origin ingress to the edge and direct-to-origin traffic has nowhere to go.
- What does origin pinning prevent?
- Pinning fixes the edge to validated, approved origins, so a forged or manipulated request can't redirect traffic to an attacker-chosen destination, a common SSRF and bypass vector.
- Does this replace my WAF and bot defenses?
- No. Origin Protection makes sure traffic can't skip them. Because the origin only accepts the edge, every request runs through your WAF, rate limits, and bot controls first.
Take your origin off the open internet
Put the edge in front, allowlist and pin your origins, and make the edge the only way in.