TRAFFIC, ON YOUR TERMS
Your perimeter. Your rules.
See what’s reaching your sites. Decide what gets through.
◇
LET’S SET YOUR BOUNDARIESYour first website starts here.
Add a domain, install a connector, and observe its traffic.
Switch to enforcement when you’re comfortable with your rules.
01 Register a site02 Connect at the edge03 Review & enforce
THE LAST 24 HOURS
Traffic at a glance
23 hours agoNow
Best-effort aggregate counts, not billing-grade analytics. Cold starts and low traffic can delay reporting.
Observe first.
Decision breakdown
Aggregate reasons only · No visitor identifiersNo connector has reported yet.
ONE ENGINE. TWO WAYS IN.
Protection belongs near your traffic.
This console does not proxy your website. Install a connector to activate observation and enforcement. A registered domain alone is not protected.
Save your site key now—it is only shown once.
This key can fetch policies and submit metrics for this site. Never put it in browser code or a public repository.
EDGE CONNECTOR Recommended for Cloudflare sites
Cloudflare Worker
Run before the origin. Forward allowed requests without reading or rewriting their bodies.
- Download the bundled Worker and deploy it in your Cloudflare account.
- Set the variables below. Store
AEGIS_SITE_KEYas a Worker secret. - Attach it to a proxied route such as
example.com/*. If you already have a Worker, integrate the engine into it; do not replace existing routing logic. - Add your saved bootstrap JSON as a Text variable named
AEGIS_BOOTSTRAP(a plain string, not a JSON binding) to cover cold starts. Otherwise cold starts allow requests until the first policy sync.
SERVER CONNECTOR Node.js / Express / Connect
Your existing application
Mount middleware before routes, database access, or expensive application work.
- Download the dependency-free Node module into your server project.
- Set the control URL, site ID and secret in your server environment.
- Configure trusted visitor IP extraction for your hosting proxy. Do not blindly trust forwarded headers.
- Install on every origin entry point. Unprotected alternate origins can bypass an edge-only layer.
PORTABLE CONNECTORS Not on Cloudflare or Express?
Runs anywhere your traffic does
Same engine, same background policy sync, still dependency-free — for the rest of your stack. Fetch / Edge covers Deno, Bun, Vercel and Netlify Edge, and Fly. Each returns 403 (block), 402 (licence) or 429 (rate limit), or passes the request through untouched.
↓ Fetch / Edge connector↓ AWS Lambda connector↓ Fastify connectorConfigure a trusted client-IP resolver before enabling rate limits, exactly as with the Node connector.
COLD-START SAFETY
Saved policy snapshot
Save this as a Text variable AEGIS_BOOTSTRAP in your connector environment (a plain string — not a JSON-typed binding). It is a cold-start snapshot only, pinned to version 1: the live policy from this console always wins once a connector syncs (about once a minute), so a slightly stale snapshot is harmless. Refresh it occasionally so brand-new instances start close to your current rules.
DECLARE YOUR AI POLICY
robots.txt & AI preferences
Machine-readable AIPREF declaration derived from your saved policy: a Content-Usage preference plus a Disallow block for each restricted AI crawler. Merge these lines into your existing robots.txt — do not replace the file. This is advisory for compliant crawlers; your installed connector still enforces the policy. Connectors also send the Content-Usage header on the responses they return.
FOR AI AGENTS
llms.txt & Markdown for agents
An /llms.txt derived from your saved policy: your AI usage preferences, how an agent identifies itself, and your licensing terms. Publish it at your site root and add a list of your key pages.
Connectors can also serve Markdown renditions of your pages to identified agents only: licensees, agents with a verified signature, and verified crawlers. An agent asks with Accept: text/markdown or by adding .md to a page path. Everyone else gets the normal page. To switch it on, set AEGIS_MARKDOWN=true on the Cloudflare Worker, pass markdownOrigin to the Fetch connector, mount guard.markdown(render) in Node or Fastify, or pass a markdown render function to the Lambda connector.
CREDENTIAL MANAGEMENT
Rotate this site’s key
Existing connectors will stop syncing until you update their key. Their cached policies remain in effect.
ACCESS CONTROL
Team members
Add a member
They must already have an Aegis account. Roles: Viewer reads, Editor manages sites & policies, Admin manages members, Owner has full control.
Invite someone new
Send an invitation to an email that doesn’t have an Aegis account yet. They set a password and join this organization at the role you choose. Invitations expire in 7 days.
Share this invitation link — it is shown once.
SINGLE SIGN-ON
OIDC single sign-on
Let members sign in with your identity provider — Okta, Microsoft Entra ID, Google Workspace, Auth0. Only an owner can change these settings.
Register this redirect URI at your identity provider:
PROVISIONING · SCIM
Auto-provision from your IdP
Let your identity provider (Okta, Entra) create and deactivate members automatically. Generate a token and give it — with the Base URL — to your IdP's SCIM app. Owner only.
Base URL:
Save this SCIM token now — it is shown once.
SSO · SAML
SAML 2.0 sign-on
For identity providers that use SAML instead of OIDC. Register the SP metadata URL at your IdP, then paste its entry point, issuer and signing certificate here. Owner only.
SP metadata URL for your IdP:
ACTIVITY
Audit log
SUBSCRIPTION
Free plan
Change plan
Upgrades take effect immediately after checkout. Only an owner can change the plan.
Organization data
Export everything this organization holds as JSON (data portability), or permanently delete it. Owner only.
Delete organization
Permanently deletes this organization and every site, policy, member, metric and history record it holds. This cannot be undone.
TWO-FACTOR
Authenticator app (TOTP)
Add a second factor with any authenticator app (Google Authenticator, 1Password, Authy, Microsoft Authenticator).
Paste this secret into your authenticator app, then enter the 6-digit code it shows to confirm.
Save your recovery codes
Each code works once if you lose your authenticator. They are shown only now.
Two-factor authentication is on for your account.
Change your password
Sign out everywhere
End every other signed-in session for your account. You will stay signed in on this device.