ScaleShield: the security and speed layer in front of every site
ScaleShield sits between the internet and your site. It handles HTTPS with your free certificate, drops abusive bots, blocks attack traffic and serves cached pages in milliseconds, all before a request reaches your PHP, your app or your database. No plugin. No configuration. No extra charge.
One layer, three jobs
What sits in front of your site
ScaleShield does three jobs on every request: it caches, it filters, and it inspects. Each one has its own page if you want the full mechanism.
G7Cloud Cache
Full copies of your WordPress pages, served from in front of your site without starting PHP or touching the database. As each page is cached, G7Cloud Cache records what it displays, so when you edit something only the pages that show it are refreshed. Nothing goes stale, and the cache never rebuilds from cold.
How precise refresh worksBot protection
A large share of raw traffic to any site is automated: scrapers, credential-stuffing scripts, spam bots, exploit scanners. ScaleShield drops it in front of your site with an invisible browser check that real visitors never notice, and verifies claimed search-engine crawlers against Google's and Bing's own published address ranges. Your SEO is safe.
How bots are filteredManaged firewall
Every request is inspected against rules that block known attack patterns: SQL injection, cross-site scripting, exploit probes against common software. The attack paths WordPress actually gets hit on (wp-login, xmlrpc) get specific rules. We maintain it all platform-wide, and rule changes take effect in about 5 seconds.
What the firewall blocksBlocked before it ever hits your PHP
A WordPress security plugin can only inspect a request after WordPress has already booted: PHP starts, the database is queried, and only then does the plugin decide the request was junk. The attacker still cost you CPU, memory and database connections.
ScaleShield works the other way round. It sits in front of your dedicated container, where the managed firewall rejects hostile requests and bot protection drops automated traffic before either reaches your site. Your site never boots for it, never queries the database for it, and never slows down real visitors because of it. That matters most on login pages, search endpoints and checkout flows, where bot traffic is heaviest.
- Hostile traffic is dropped in front of your site, before it reaches your container
- Junk traffic consumes zero PHP workers and zero database connections
- Login and admin endpoints are shielded from credential-stuffing bots
- One layer, maintained by us: no rule sets for you to keep updated
The attack is blocked, but it already cost you server resources.
Hostile traffic never touches your container. Your resources serve real visitors only.
The rendered page is stored in front of your site, along with a record of what it displays.
Served in milliseconds. PHP never starts and the database is never queried.
Served before it ever hits your PHP, too
The same layer that blocks hostile traffic also serves your pages. G7Cloud Cache keeps full copies of your WordPress pages in front of your site, so a cached page is served in milliseconds without starting PHP or touching the database. Your site's own resources stay free for the visits that need them: checkout, admin, search.
As each page is cached, G7Cloud Cache records what that page displays: which posts, categories, menus, sidebars and widgets it rendered. Edit something and only the pages that actually show it are refreshed, instantly and automatically. Nothing goes stale, and the cache never rebuilds from cold. The full mechanism is on the G7Cloud Cache page, and it pairs with the managed object-cache add-on that speeds up the dynamic pages the cache leaves alone.
- Nothing to install: no caching plugin, no TTLs, no exclusion rules
- Logged-in visitors, carts, checkouts and wp-admin are never cached
- WooCommerce-safe: you cannot serve one customer another customer’s basket
- Static files and images are cached in front of your site too
Rate limits, country rules and an attack switch
ScaleShield also carries the controls you hope never to need, plus per-site allow and block lists. We run all of it for you.
Rate limiting
Floods of requests from one source are slowed and stopped before they reach your site.
Country rules
Allow, challenge or block traffic per country (all 243 of them) or by whole continent. Useful when a store only ships to the UK.
Attack mode
Under a determined attack we flip a single switch, and every visitor without a verified-human pass gets the browser check while the attack lasts. Real visitors barely notice. The flood stops reaching the site.
Automatic bans
Trap links that only bots follow, plus a per-address reputation score that decays over time, so one bad request years ago does not brand a visitor forever. Repeat offenders are banned automatically.
Free wildcard TLS
Certificates are issued and renewed automatically on every site, wildcards included. You never touch a certificate.
Watched by us
We maintain the rules platform-wide and watch a live console with automatic anomaly detection: a traffic spike or block surge flags itself to us. You maintain nothing.
One layer for every site: the same protection whether you run WordPress, WooCommerce, a Node.js app or a site built with the AI Website Builder.
On by default. Nothing to manage.
ScaleShield activates the moment a site goes live on G7Cloud, whether it's a managed WordPress site, a git-deployed app, or a site you shipped with the AI Website Builder. There is no onboarding step, no rules dashboard you are expected to babysit, and no premium security tier.
No plugin to install, no cache settings to tune
The protection and the cache live in front of your site, outside it entirely. No TTLs or exclusion rules to maintain.
No certificates to renew
TLS certificates (including wildcards) are issued and renewed automatically.
No rules to maintain
Firewall and bot rules are managed by us, platform-wide, for every customer at once.
No security surcharge
ScaleShield is part of the platform baseline on every plan, Free included.
ScaleShield works best with the rest of the platform
The security and speed layer in front of your site is one layer of the platform. It pairs with the rest of what every G7Cloud site gets:
- Per-minute uptime monitoring so you know your site is up, checked every minute.
- Backups that are restore-tested nightly (the recovery layer for when something goes wrong inside the site itself).
- Dedicated containers, one per site, behind ScaleShield. Nothing shared, nothing queued behind a neighbour.
ScaleShield FAQ
What the security and speed layer in front of your site does and doesn't do.
Is ScaleShield included on every plan?
Yes. ScaleShield sits in front of every site on G7Cloud, including sites published on the Free plan of the AI Website Builder. The firewall, bot protection, G7Cloud Cache and TLS are all part of it. It is not an add-on and there is nothing extra to pay.
What does ScaleShield actually include?
Free automatic TLS certificates (wildcards included), a managed web application firewall (WAF) that blocks known attack patterns, bot detection with an invisible browser check, full-page WordPress caching through G7Cloud Cache, rate limiting, per-country traffic rules and an attack mode for determined attacks. We maintain all of it, and rule changes take effect across the platform in about 5 seconds.
What is G7Cloud Cache?
G7Cloud Cache is the full-page WordPress cache built into ScaleShield. It serves complete copies of your pages from in front of your site, without starting PHP or touching the database, so cached pages are served in milliseconds. As each page is cached it records what that page displays, so when you edit something only the pages that actually show it are refreshed. Logged-in visitors, carts, checkouts and wp-admin are never cached.
Do I still need a caching plugin or a security plugin?
You no longer need a caching plugin: G7Cloud Cache does full-page caching in front of your site, with no settings pages of TTLs and exclusion rules to maintain. On the security side, ScaleShield replaces the firewall and bot-blocking layers of a typical security plugin, and it works before a request ever reaches WordPress. Plugins that do other jobs (malware scanning inside wp-content, for example) can still be useful.
Will ScaleShield block search engines or real visitors?
No. Traffic that looks automated gets a quick, invisible browser check rather than a block, and real visitors pass through without noticing. A visitor claiming to be Googlebot or Bingbot is checked against Google's and Bing's own published address ranges, so genuine search-engine crawlers are never challenged or blocked. Impostors are treated as the bots they are.
How do custom domains connect to ScaleShield?
You point an A record at 31.132.2.56, which is ScaleShield. Traffic arrives there first, gets its HTTPS handled with your free certificate, is filtered and checked against the cache, and clean requests are forwarded to your dedicated container.
Is there anything to install or configure?
No. ScaleShield is active from the moment your site goes live: firewall, bot protection and G7Cloud Cache included. There is no plugin, no cache settings to tune, no DNS puzzle beyond a single A record for custom domains, and no rule set for you to maintain.