NexShield

NexShield (nexpanel-shield) runs on each node and reads the web server's access logs in real time. When a client behaves abusively — scanning for vulnerable files, brute-forcing logins, flooding a site — NexShield escalates:

1. Challenge — the visitor gets a short browser check page; real browsers pass on their own.
2. Tarpit — responses to the client are slowed down.
3. Ban — the client's address is dropped by the firewall for a time.

Modes#

• Observe — NexShield logs what it would do without acting. Start here to check a new server.
• Enforce — NexShield acts.

Turn NexShield on per node in Security › NexShield and choose the mode. One fleet-wide policy and whitelist are sent to every node.

IP reputation and countries#

• IP reputation — known abusive addresses from public lists are blocked before they reach the web server. Bans can be reported to AbuseIPDB when you add an API key.
• Country blocking — block or challenge visitors from chosen countries.

AI bots#

Security › NexShield › AI bots lists known AI crawlers in three groups — training crawlers, AI search crawlers and assistants that fetch a page for a user — and lets you refuse each one.

Statistics#

The NexShield overview shows requests, blocks, challenges solved and bans per minute for the whole fleet, the busiest sites and the most frequent WAF rules. Per-domain traffic (requests per second, bandwidth, 5xx rate) also appears on each node overview.