Guard Core

Protect your APIs

Advanced security middleware with real-time threat detection, IP filtering, rate limiting, comprehensive monitoring and more.

Try on PlaygroundGet Started
Guard Core - trending on PeerPushGuard Core rating on PeerPushGuard Core on Nick LaunchesFeatured on FoundrList

What Cloudflare misses, and why

Three consecutive weeks from a single production deployment. Same app. Same codebase. Cloudflare added between week 1 and week 2.

Mar 23 - Mar 29

Pre-Cloudflare baseline

745

attacks blocked

74

unique attackers

Background-radiation reconnaissance: .env / .git / wp-config probes. The kind of low-sophistication scanning every public service sees. Guard caught all of it before any edge layer was in front.

Mar 30 - Apr 5

Cloudflare in front. Guard still caught 48.

48

attacks blocked

19

unique attackers

Cloudflare's free WAF ate the obvious 93% of traffic. The 48 attacks Guard caught looked exactly like normal browsers: Mozilla user agents, real referrers, real-looking IPs. That's the slice edge WAFs are structurally blind to.

Apr 6 - Apr 12

748 attacks. Zero unique attackers.

748

attacks blocked

0

unique attackers

A coordinated burst over one hour, distributed across rotating identities, targeting API enumeration paths. Each request looked legitimate to the edge. Framework-embedded behavioral correlation saw the targeting and shut it down.

Edge WAFs work at L7 headers and IP reputation. Guard works at the framework layer with behavioral context: which authenticated user did what, on which endpoint, with which decorator chain. AI-coordinated attacks have to reveal intent there. They don't have to at the edge.

Security Features

Comprehensive API protection with cutting-edge security middleware

Coordinated Attack Detection

Spots dozens of residential-proxy IPs attacking as one across all your instances, when no single IP trips a per-IP ban. SaaS-only cross-IP correlation the standalone library can't see

Behavioral Correlation

Per-endpoint × per-IP windowed tracking with detection-correlated thresholds. An IP that just tried SQLi gets banned at half the 404-sweep threshold

16-Category Detection

NFKC normalization + 21 lookalike substitutions, 3-pass URL/HTML decoding, then context-aware regex (72 patterns) and semantic scoring (5 attack families). Beats polymorphic AI payloads

End-to-End Encryption

AES-256-GCM with project-scoped keys, fork-safe transport, and persist-confirm Redis recovery. Telemetry stays unreadable to us, third parties, and breached infrastructure

Decorator-Based Policy

Compose @rate_limit, @require_ip, @geo_rate_limit, @require_2fa per endpoint. Edge WAFs can't see this; framework-embedded guard does

Dynamic Rule Updates

Update IP bans, rate limits, blocked countries, and detection rules at runtime from the dashboard. Connected agents pick them up on their next poll cycle - no redeploy

Per-Category Threat Bans

Set ban thresholds and durations per attack category. SQLi or cmd_injection trips a 24-hour ban on the first hit; recon scanning a softer one

Multi-Framework SDK

One security engine, every framework. FastAPI, Flask, Django, Tornado, Express, Fastify, Hono, NestJS, Actix, Axum, Rocket, Tower

Real-Time Telemetry

Hosted dashboard with weekly threat reports, top attacked paths, attacker geo, daily heatmaps, and CSV/JSON export

GDPR-Ready

Built-in consent management, audit logs, retention split between regulatory and operational windows, and self-service data export / deletion flows

Geo-Blocking

Country-level allow/block lists with real-time IPInfo geolocation and timezone-aware time-window restrictions

IP Reputation

Whitelist/blacklist with CIDR, automatic ban escalation on auto_ban_threshold, and configurable lockout windows

Cloud Provider Blocking

Reject traffic originating from AWS, GCP, Azure, OCI, DigitalOcean, Linode, Vultr ranges. Daily auto-refresh from upstream

Webhook Notifications

SSRF-validated outbound webhooks with idempotency keys for downstream dedup. Stripe-style retry with auto-disable on persistent failure

What You Get Out of the Box

✓Behavioral correlation across IP-rotation
✓16-category contextual detection (XSS, SQLi, SSRF, …)
✓End-to-end encryption with key rotation
✓Per-endpoint decorator policy
✓Dynamic rule push from dashboard
✓Multi-framework SDK (Python / Node / Rust / Go / PHP / Java)
✓Webhook idempotency + SSRF protection
✓GDPR audit + retention + data-export flows

Get Started in Under 2 Minutes

Simple integration with your existing application

Guard Core Ecosystem

6 languages·23 adapters
guard-core
Core

Framework-agnostic security engine (Python)

190K downloads12 stars48 versions
uv add guard-core
fastapi-guardFastAPIMOST POPULAR
1
Install
uv add fastapi-guard
2
Integrate
from fastapi import FastAPI
from guard import SecurityMiddleware, SecurityConfig

app = FastAPI()

config = SecurityConfig(
    rate_limit=100,
    auto_ban_threshold=5,
    blocked_countries=["CN", "RU"],
    enable_penetration_detection=True,
)

app.add_middleware(SecurityMiddleware, config=config)

Core Protection Features

  • ✓Rate limiting & IP banning
  • ✓SQL injection & XSS protection
  • ✓Geographic restrictions
  • ✓Suspicious pattern detection
guard-agentFastAPI · TelemetryTELEMETRY
1
Add telemetry to your SecurityConfig
# guard-agent ships with fastapi-guard, no extra install.

config = SecurityConfig(
    # ...protection settings...

    enable_agent=True,
    agent_api_key="YOUR_API_KEY",
    agent_project_id="YOUR_PROJECT_ID",
    agent_buffer_size=5000,
    agent_flush_interval=2,
)

# Middleware drives the lifecycle, no lifespan needed.

Monitoring & Analytics

  • ✓Real-time security events
  • ✓Performance metrics tracking
  • ✓Automatic event buffering
  • ✓Cloud dashboard integration

From the blog

Updates, security research, and field notes.

15 min read

Beyond rate limiting: what application-layer security actually means in 2026

Most API security tutorials still teach the 2018 playbook - rate limit by IP, validate inputs, log to stdout. AI-coordinated attackers eat that for breakfast. Here's what modern application-layer security actually looks like, layer by layer.

9 min read

I put Cloudflare and fail2ban in front of my FastAPI server. Here's what still got through.

Edge protection dropped my attack volume by 94%. Then I watched 748 Layer 7 attacks hit in a single hour anyway. This is the data, and it's a useful lesson about what application security actually protects against.

5 min read

Who Guard Core is actually for

Not everyone runs a public API that wants to be found. If you're building in stealth, enforcing hard limits, running honeypots, or just don't want to stand up fail2ban and Cloudflare, this is for you.

View all posts →

See Guard Core in Action

Experience our security features in real-time with our interactive playground

playground.guard-core.com

Test Attack Scenarios

Simulate SQL injection, XSS, and brute force attacks

Real-time Monitoring

Watch security events and blocks as they happen

Interactive API

Test endpoints with built-in security middleware

Launch Playground

No signup required