Citadel sits in front of HTTP/HTTPS applications and decides what should pass, be challenged, slowed, cached, escalated or blocked — before your origin spends CPU, database work and bandwidth.
Decision log
How it connects
Cloudflare stays your DNS and edge. Citadel is the reverse proxy behind it that decides which requests reach your origin.
Enter the origin IP or hostname, the port and the TLS-to-origin setting.
Copy the ingress IP from the domain page. In Cloudflare DNS, point the apex and each protected hostname to it with Proxied on, and set SSL/TLS to Full.
It checks about every minute, or select Check connection. The domain changes from Awaiting DNS to Active.
| Type | Name | Content | Proxy status |
|---|---|---|---|
A | @ | Citadel ingress IP | Proxied |
A | www | Citadel ingress IP | Proxied |
MX | @ | Your mail server | DNS only |
Mail, TXT and other non-web records do not change. A DNS-only (grey cloud) web record skips Citadel. Cloudflare setup guide
Citadel protects Layer 7 HTTP/HTTPS traffic. Network-layer mitigation is a separate edge task.
Attack timeline
A 17-minute HTTP flood, drawn with the Edge, Proxy and Blocked series that Citadel Analytics uses. Move across the chart to read each moment.
Why Layer 7 is different
That is why Citadel focuses on requests, paths and sessions instead of pretending every DDoS problem is just a bandwidth problem.
High request volume that looks valid enough to make the application and database do real work.
Auto with a rate-limit preset. Auto escalates during the flood and heals when traffic calms.
Repeated authentication attempts that target expensive login paths instead of the whole site.
Interaction during active abuse. Allowlist API and webhook paths first, because they cannot click.
Bots and scrapers that can pass simple network checks but do not behave like a normal browser session.
JS or Auto. Clients that cannot complete the browser check stop at the edge.
Short spikes that should not permanently block a customer, but still need an immediate response.
Rate-limit presets with strikes. The client recovers automatically when the ban expires.
Control surface
Citadel is designed so an operator can understand why traffic changed state without guessing what an invisible black box decided.
Pick how much friction a domain adds. Select a level to see who gets through.
Starts at a calm baseline, escalates during an attack and heals when traffic calms. The starting point for public websites.
Matching clients bypass challenges, including Lockdown.
/api/203.0.113.0/24StatusMonitor/2.1Repeat offenders escalate step by step instead of one blunt rule.
Eligible static responses come from cache, so repeat requests skip origin work.
.css.jsimagesfonts/api//admin/Email and webhook events, plus health probes with latency and status.
Paste an HTML shell per page type. Citadel injects the real verification controls.
<h1>{{BRAND}}</h1>
<p>{{MESSAGE}}</p>Access entries with method, path, status, IP, ASN, country and latency. Security entries for challenges, blocks, rate limits and bypasses. Error entries for origin 502, 503 and 504. Trace one request by its ID. Kept for 15 days, with sensitive query values redacted.
r-7f3aGET/pricing200Proxiedr-81c2POST/login403Challenge failedr-9d04GET/search?q=[redacted]429Rate limitedr-a6e1POST/api/webhook200Allowlisted bypassr-b257GET/checkout502Origin unreachabler-c9f8GET/reports504Origin timeoutCitadel portal
Every setting on this page is self-serve. Billing, invoices and tickets stay in the StealthRDP client area.
Plans
Start free, then scale the allowance when the number of protected properties or clean traffic grows.
For smaller websites that want the same core request controls.
For production sites that need more protected domains and traffic.
For multi-site deployments and larger clean-traffic allowances.
Start with the free tier, then tune protection by domain and path as traffic changes.