lyxvo security

Lyxvo Security

A firewall and captcha for any website

Lyxvo WAF stops scanners, injection attacks and floods before they reach your app. Lyxvo Captcha keeps bots out of your forms without puzzles or tracking. Works with any stack: one API call from your server, one script tag on your page.

Protect a site freeRead the docs
  • Free plan, no card
  • Any language or host
  • Attack log in real time
POST https://security.lyxvo.ai/api/security/check
Authorization: Bearer lxs_sk_…
{ "ip": "203.0.113.7", "method": "GET",
  "url": "/search?q=1' UNION SELECT password FROM users" }

→ { "action": "block", "status": 403, "kind": "sqli" }

What you get

Attack signatures

SQL injection, XSS, path traversal, command injection, SSRF, XXE, template injection, Log4Shell, NoSQL injection and PHP wrappers, matched in the decoded URL and body.

Scanner and bot traps

sqlmap, Nikto, Nuclei, ZAP, Acunetix and 40 other tools are known by their User-Agent, headers and callback domains. Probes for .env, .git, backups and other CMS panels are trapped.

IP scoring and blocks

Every finding adds to the IP's score. A real payload blocks the IP at once; weaker signals add up within 15 minutes. Floods get a one-hour block.

Your rules

Allow and block lists (IP or IPv4 range), blocked countries, a request-per-minute limit, and a monitor mode that only logs while you test.

Lyxvo Captcha

The visitor's browser solves a small proof-of-work in about a second. No image puzzles, no cookies, no third-party tracking. Signed, single-use, expires in 5 minutes.

Dashboard

Every blocked request with its IP, country, path and attack type. Attacks per day, top attackers, and one click to unblock an IP.

How it works

  1. 1

    Add your site

    Sign in, add your domain and get a site key (public) and a secret key (server only).

  2. 2

    Call the check

    Your server sends each request's IP, method, URL and headers to the check API and refuses it when the answer is block. Examples for Node, Next.js, PHP, Python, Go and Cloudflare Workers.

  3. 3

    Add the captcha

    Put the widget in your form and verify its token on your server with your secret key.

Try the WAF

Type a URL path, User-Agent or form body and see what Lyxvo WAF would do. Nothing is logged.

Try:

Try the captcha

This is the real widget. When it shows Verified, press Send: the token is checked by the server like yours would.

<div class="lyxvo-captcha" data-sitekey="lxs_pk_…"></div>
<script src="https://security.lyxvo.ai/captcha.js" async defer></script>

Pricing

Start free. Upgrade when your traffic grows. Paid with USDT; monthly.

Free

$0

  • 1 site
  • 10k WAF checks a month
  • 10k captcha checks a month
  • 7-day attack log
  • Every signature, rule and captcha
Start free

Pro

$9.99/month

  • 5 sites
  • 1M WAF checks a month
  • 1M captcha checks a month
  • 30-day attack log
  • Every signature, rule and captcha

Business

$29.99/month

  • 25 sites
  • 5M WAF checks a month
  • 5M captcha checks a month
  • 90-day attack log
  • Every signature, rule and captcha

Over the limit, your site keeps working: checks are allowed and the dashboard tells you.

Need more, or setup help on your stack? Write to hello@lyxvo.ai.

Questions

Does it work with my website?

Yes, if your server can make an HTTPS request: Node, Next.js, PHP and Laravel, WordPress, Python, Go, Ruby, Cloudflare Workers and more. The captcha is one script tag on any page.

What if Lyxvo Security is down or slow?

The examples fail open: if the check doesn't answer within a short timeout, your request goes through. Your site never goes down because of us.

Will it block real visitors?

The signatures match patterns real input almost never contains. Start in monitor mode to see what would be blocked, then switch to block. Unblock any IP from the dashboard.

Is the captcha private?

Yes. It sets no cookies and loads nothing from third parties. The browser does a small computation; the server checks it.

A firewall and captcha for any website

Protect a site free