Speed and burst control
Captain Security watches how fast every visitor moves through your site. A person browses. A bot hammers. It knows the difference.
Captain Security
Every visitor checked before they touch your site.
Captain Security is the website firewall we built ourselves. It scores every request the moment it arrives, waves real customers and real search engines straight through, and stops the bots, scanners and break-in attempts that hit every business website, every day.
5M+Requests Scored
111.4K+Threats Filtered
50K+Unique IPs Analyzed
Real customers never see it. Bots can't get around it.
No puzzles, no checkboxes, no "click every traffic light." Captain Security judges how a visitor behaves, not just what it claims to be.
Bot fingerprinting
Headless browsers, automation frameworks and scripted tools like Selenium, Puppeteer and curl are spotted even when they pretend to be Chrome.
Form spam stopped
Hidden honeypot fields and submit timing catch bots on your contact, quote and login forms. A person cannot fill out a form in under a second. A bot can.
Search engines welcome
Google, Bing and the other real crawlers go straight through, confirmed by reverse DNS. A fake Googlebot is treated like the impostor it is.
Signed verification
Real browsers earn a signed verification cookie and signed form tokens. A forged one gives an attacker away on the spot.
Fair by design
Looking unusual is never enough to get banned. Bans are earned by behavior, so your payment notifications, uptime monitors and integrations keep working.
It knows what an attack looks like before it lands.
Scanners hit thousands of sites a day looking for the same few unlocked doors. Captain Security recognizes the knock.
Secret file probes
.env files, .git folders, AWS and SSH keys, password files: the first things a scanner asks for.
WordPress break-in routes
wp-config.php, debug logs and xmlrpc.php, the classic WordPress break-in and password-spray paths.
Admin tool hunting
phpMyAdmin, Adminer, cPanel, webmail and shell probes, flagged the moment they arrive.
Backup theft
Requests for .sql dumps, .bak files and zipped site backups, the fastest way to steal a whole site.
Wrong-platform probes
WordPress or PHP paths requested from a site that is not built on them, a dead giveaway of an automated scanner.
Updated from one place
New attack signatures go live on every protected site from our Command Center. No plugin update, no waiting.
Watch. Score. Challenge. Stop.
Captain Security does exactly as much as each visitor earns, and not one step more.
Watch
Every request to your site is checked: who is asking, how fast, and for what.
Score
More than twenty signals combine into one threat score. Real visitors score near zero and never notice a thing.
Challenge
Suspicious traffic is quietly slowed down and asked to prove it is a real browser, with a background check a person never sees.
Stop
Anything that keeps misbehaving is cut off and banned, and every attempt is logged so you can see exactly what was stopped.
On WordPress. Built into everything we build.
Whatever your site runs on, Captain Security sits in front of it and reports back to one place.
Captain Security for WordPress
A full WordPress plugin that stays out of your dashboard and away from your logged-in admins, works with caching and other security plugins, and keeps your site serving even if it cannot reach us. A built-in health check shows you exactly what it is doing.
Built into every site we build
Every website our builder creates ships with Captain Security already wired in. Nothing to install, nothing to configure.
Locked to your domain
Each site key works on one domain only, proven by your live site. Copy it to another site and it is refused, and you are told.
Tuned by our team
Thresholds, allow lists and block lists are managed per site from our Command Center, without touching your website.
Your security, in plain English.
Your client portal checks four things automatically, every hour, and tells you exactly where you stand.
Firewall activity
Requests checked today, threats challenged and attackers stopped, live.
Malware scan
Your hosting account scanned for malicious files.
Security hardening
Six protective security headers, read straight off your live site.
SSL certificate
Exactly how many days until your certificate renews.
Enterprise-grade protection. Small-business price.
One site, one price, for the whole year.
Website firewall and bot protection, per site.
$99/yr
Included at no extra cost with every website Captain Obvious builds.
Captain Security questions, answered
No. Real visitors are scored silently as the page loads, and a normal customer never sees a puzzle. Only traffic that is already behaving like a bot gets slowed down.
No. Google, Bing and the other major search engines are confirmed by reverse DNS and go straight through. Fake crawlers pretending to be Google do not.
Yes. Captain Security is a full WordPress plugin. It stays out of wp-admin and away from logged-in administrators, works with caching plugins, and never changes your other plugins' settings.
Your site keeps running. The WordPress plugin holds its reports locally and keeps serving your visitors until it can reach us again.
Captain Security works alongside it. If another firewall is already blocking traffic, it adapts and recommends the right setup instead of fighting it.
No. Each key is locked to one domain and proven by your live site. A copy used anywhere else is refused, and the attempt shows up in your portal.
Your client portal shows live firewall activity, a malware scan, a security-settings check and how many days your SSL certificate has left, updated every hour, in plain English.
Every website we build comes with Captain Security included. For any other site, it is one yearly price per site, shown in the plan above.
Ready to put Captain Security in front of your website?
Tell us about your site and we will show you what is already knocking on the door.