What is TurboShield?
TurboShield is TurboStack's built-in protection layer for web traffic. It sits in front of every application on a host and inspects each request before your application code sees it. It decides whether a visitor is a normal user, a useful bot, an unwanted crawler, or an attacker, and responds accordingly - from letting the request through untouched, to slowing it down, to blocking the source for a while.
TurboShield is enabled by default and runs at the host level, so it protects every application on that host.
Why it exists
A public application is visited by far more than customers. It is also crawled by search engines, scraped by price-comparison and AI training bots, probed by automated vulnerability scanners, and occasionally targeted by a real attack. Handling all of that inside your application is slow and expensive: every request that reaches your code costs processor time, database queries and memory.
TurboShield filters that traffic at the edge, so your server spends its capacity on real visitors.
How TurboShield protects your site
TurboShield is not one filter but several independent mechanisms. They all run together, and each one catches something the others cannot.
1. Rate limiting
TurboShield counts how many requests and how many simultaneous connections each visitor makes. A visitor who asks for far more than a human possibly could is slowed down, and beyond a hard ceiling their excess requests are refused with an HTTP 429 ("Too Many Requests").
This runs continuously, not only during an attack. It is the always-on floor of protection that stops one visitor, or one badly written bot, from consuming all your server capacity.
Important
Being rate-limited is not the same as being banned. A 429 is temporary and recovers by itself as soon as the visitor slows down. Rate limiting never escalates into a block. Only unmistakable attack behavior leads to a ban, so a busy but legitimate visitor is never locked out.
2. Bot classification
Every request states who it is (its user agent). TurboShield sorts that claim into four classes, each with its own limits:
This lets search engines index your site at full speed while crawlers that only cost you capacity are held back. Human visitors are unaffected.
3. Search-engine verification
Scrapers routinely claim to be a search engine to escape bot limits. TurboShield only believes that claim when the request also comes from that search engine's officially published address ranges, which it keeps up to date automatically.
Real search engines keep their fast lane. A scraper pretending to be one does not, and at the strictest protection level is refused outright.
4. Trusted clients
Addresses you mark as trusted skip every TurboShield check. This is the one setting to use for your own office, a partner integration, or an external monitoring service that must never be slowed down or blocked. See trusted clients.
TurboShield also recognizes a number of well-known integrations by their request pattern, so common platform connectors keep working without configuration.
5. Known-exploit blocking
When a vulnerability becomes publicly known, attackers begin scanning for it within hours - often long before every site has installed the fix. TurboShield recognizes the specific request shapes that exploit such vulnerabilities and refuses them before they reach your application.
This acts as a temporary patch at the network edge. It protects you during the window between a vulnerability becoming public and your application being updated. It does not replace updating your application.
6. Attack detection and temporary bans
This is the layer that recognizes attack behavior rather than volume. TurboShield continuously reads your server's access logs and looks for patterns that a single request never reveals:
- Probing for injection and cross-site-scripting weaknesses.
- Scanning for sensitive files such as configuration files, backups or version-control data.
- Hunting for known vulnerabilities and previously planted backdoors.
- Repeated failed logins against administration panels, SSH and FTP.
When a source shows this behavior, TurboShield bans it temporarily. The ban applies both at the web server and at the network firewall, so the source is cut off from every service, not just the application. Confirmed exploit attempts get a long ban; weaker behavioral signals get a short one.
Two properties matter here:
-
The ban uses the real visitor address, so it still works correctly when your site sits behind a content delivery network.
-
Every ban expires automatically. Repeat offenders are banned for longer, but nothing is ever blocked permanently by automated detection alone. A false positive is always time-limited.
7. Shared reputation
Besides what it observes on your own server, TurboShield checks incoming addresses against continuously updated lists of sources already known to be malicious elsewhere. An attacker that has been active against other sites is blocked on their very first request to yours.
8. Bot challenge (optional)
For sites that suffer from scraping or credential stuffing spread across many addresses, you can switch on the bot challenge. Suspicious visitors first receive a short automatic browser check, similar to the "checking your browser" page you may know from large networks. A real browser solves it in a fraction of a second and is then remembered for a few hours. A script pays a real computational cost on every single request, which makes large-scale automated abuse uneconomical.
The challenge is deliberately independent of the protection level. It activates based on the actual load on your server combined with how suspicious each request looks, so a quiet site under attack is still protected and a busy healthy site is not bothered with needless checks.
Interfaces that cannot solve a browser check - APIs, webhooks, payment callbacks and health checks - are excluded automatically, and you can add your own exceptions. See bot challenge.
Note
The bot challenge is off by default and only applies to hosts running Nginx. Turn it on when you actually have a bot problem that rate limiting alone does not solve.
9. Distributed attack detection (strictest level only)
A modern scraping attack spreads across hundreds of addresses that each send only a handful of
requests, so no single address ever reaches a rate limit. At the attack level TurboShield also
groups traffic by its technical fingerprint rather than by address, which reveals such a swarm and
throttles it as a whole.
At the same level TurboShield also detects clients that claim to be a normal browser but contradict themselves technically, which is a reliable sign of disguised automation.
Normal browsing within your site is explicitly excluded from these checks, so adding to a cart or completing a checkout is never affected.
Protection levels
One setting, the protection level, tunes how aggressive the limits are. The default is
medium. The mechanisms above run at every level - the level changes their thresholds, and unlocks
the two attack-only mechanisms.
Tip
Stay on medium unless you have a reason not to. Raise the level while an incident is running
and lower it again afterwards. Running permanently at attack can affect legitimate visitors and
API clients.
How TurboShield relates to the other security features
TurboShield and the Firewall work together: the trusted-client list is shared between them, and TurboShield enforces its bans through the same firewall.
Related
- Configure TurboShield - all settings and lists
- Host Security tab
- Security overview
- Firewall