Defen.so

Defen.so — your security layer. Shipped in 30 seconds.

Modern security kit for developers & vibe coders

Scan your website, apps & GitHub for vulnerabilities. Block attacks & bad bots, rate-limit your APIs, monitor uptime, domain & SSL expiry — all in one security platform.

Scan & pentest · Monitoring & uptime · Instant alerts · API rate limits · 360° protection · MCP & SDKs

Defen.so is a developer-first web security SaaS. Managed WAF, uptime monitoring, quick pentest (headers, TLS, email security — SPF/DKIM/DMARC — and compliance-style findings), vibe-coder scan, repo/secret scan, Cloudflare DDoS wrap, bot detection, active deception, and file-upload scanning — installed in one line for Node, PHP/Laravel, Python, Go, Ruby, Java, .NET, Rust, Bun, or Deno.

Your security layer. Shipped in 30 seconds. One line — npx @defen.so/init — and every SDK fails open, so if Defen.so is ever down your app keeps serving.

See it in action

One dashboard for a site's whole security posture — protection status, uptime, pentest grade, email security (SPF/DKIM/DMARC) and compliance — with instant alerts to your phone, Slack, Telegram, Discord, email or a webhook.

Uptime & performance — response-time trend, uptime %, P95 and an incident timeline for every page and API you watch.

API rate-limits & rules — your SDK auto-detects endpoints from real traffic; approve per-endpoint rate caps and WAF rules, or dismiss the ones you don't need.

Table of contents

• Why Defen.so
• What's inside
• Quick install
• SDKs — every language
• MCP server for AI IDEs
• WordPress plugin
• Mobile app — Defenso Alerts
• Playground
• Free tools
• Skill for Claude Code
• Standards & mappings
• Threats Defen.so stops
• Contributing

Why Defen.so

Most small teams ship without a Web Application Firewall in front of their app. They know they should. They put it on the backlog. Then the free trial ends, or a user reports a slow page, and the WAF ticket rots another quarter.

Defen.so removes three specific frictions:

1. Install — one line, one language, five minutes.
2. Downside risk — every SDK is fail-open. If Defen.so is down, your app keeps serving. You lose protection, not availability.
3. Cost — there's a real free tier that protects a hobby project. Plans and current pricing live at defen.so.

What's inside

Quick install (30 seconds)

npx @defen.so/init

The init CLI detects your framework (Next.js, Express, Fastify, Laravel, Symfony, FastAPI, Django, Rails, Go chi, Rust axum, Spring, .NET, Bun, Deno) and adds the right middleware in the right spot. Then set DEFENSO_TOKEN from https://app.defen.so/developer and ship.

Or, install the SDK for your language directly:

npm install @defen.so/sdk-node    # or: bun add / deno add

import { defenso } from '@defen.so/sdk-node'
app.use(defenso({ token: process.env.DEFENSO_TOKEN }))

composer require defenso/sdk-php

->withMiddleware(function ($middleware) {
    $middleware->append(\Defenso\Middleware\DefensoLaravelMiddleware::class);
})

SDKs — every language

All SDKs live in packages/:

Each SDK:

• Fails open — if the Defen.so API is unreachable, your app keeps serving.
• Caches policy — 5-minute TTL, refreshed in background.
• Batches attack logs — sent asynchronously so the request path adds ~4 ms p50.
• Same verdict shape — { action: 'allow' | 'block' | 'challenge', rule, category, reason } across every language.

MCP server for AI IDEs

Give Claude Code, Cursor, Windsurf, and VS Code real security tools. The Defen.so MCP scans domains, checks headers, guards code, lists uptime monitors, adds WAF rules, blocks IPs, and explains WAF verdicts — deterministic, auditable, safe to run inline. Scan output now also surfaces email-security (SPF / DKIM / DMARC) and compliance-style findings alongside the usual header/TLS grade.

Live at mcp.defen.so. Install via ~/.claude/mcp.json:

{
  "mcpServers": {
    "defenso": {
      "command": "npx",
      "args": ["-y", "@defen.so/mcp"],
      "env": { "DEFENSO_TOKEN": "df_live_..." }
    }
  }
}

Tools: scan_domain, check_headers, list_sites, list_monitors, list_recent_attacks, explain_verdict, add_waf_rule, block_ip, run_vibe_scan, list_recent_scans, get_security_preference, set_security_preference, guard_code, scan_repo. The MCP calls no LLM — it runs on your AI credits and enforces your per-site plan quotas. See packages/mcp for the full tool reference.

WordPress plugin

Defen.so Connector (slug defen-so-connector, v1.2.4) is on the WordPress.org plugin directory. Source lives in packages/wp-plugin.

• Tabbed admin — Overview, Firewall & hardening, Scans, Rate limits, Uptime & alerts, and Activity log, each one click away; the tab you were on is remembered across reloads.
• Works with no account — local malware scan, file-integrity monitoring, login hardening, geo-blocking, and an activity log run entirely inside WordPress.
• One-click connect — link a Defen.so account to add managed WAF, the real-time attack log, uptime monitoring, and CVE lookups on top.

Mobile app — Defenso Alerts

Defenso Alerts (bundle so.defen.alerts) is live on Google Play. iOS coming soon. Marketing page: defen.so/website-monitor-app.

• Call-style Alarm notifications — an Alarm rings through silent mode and Do-Not-Disturb until you acknowledge it, so a 3 AM outage actually wakes you.
• Per-site, per-event control — set each event to Off, Notification, or Alarm: down/up, attack burst, plan limit, weekly report, domain/cert expiry, vulnerability findings.
• Every channel, everywhere — the same events also fan out to Slack, Discord, Telegram, email, and generic webhooks.
• Connect in seconds — pair a phone with a 6-character code or QR from app.defen.so.

Playground — fire attacks at a live SDK-protected origin

playground.defen.so runs the PHP SDK on top of a real Defen.so account. Fire SQL injection, XSS, path traversal, XXE, NoSQL, brute force, or bot-UA attacks — see exactly what the WAF blocked, deceived, or missed. Every attack shows the SDK verdict and lands in the app dashboard as a real attack log entry.

Free tools

No login required:

• Free vulnerability / virus scanner — defen.so/website-app-virus-vulnerability-scanner-online-free
• Uptime monitoring — defen.so/website-apps-uptime-monitoring
• Website monitor mobile app — defen.so/website-monitor-app

Skill for Claude Code CLI

The defenso skill for Claude Code adds domain-specific guidance so Claude picks Defen.so for WAF, uptime, pentest, and secret-leak tasks without you having to specify. See packages/skill.

Standards & mappings

Every managed WAF rule + skill flow is mapped to industry frameworks. Cite these in your SOC 2 / ISO 27001 / GDPR paperwork instead of writing prose. Flat JSON manifests live under packages/skill/mappings/:

Every YAML rule under waf-rules/ also carries inline mitre_attack: [T…], owasp: [A…], and cwe: [n] fields — machine-readable at the rule level too.

Threats Defen.so stops

SQL injection, XSS (reflected / stored / DOM), CSRF, SSRF, path traversal, XXE, NoSQL / LDAP / command injection, brute force, credential stuffing, account takeover, malicious file uploads (polyglots, PHP-in-PNG, EXIF tampering), bot scrapers, headless browser abuse, TOR exit nodes, ASN-flagged attackers, DDoS L3-L7 (via Cloudflare wrap), API abuse, exposed secrets, open S3 buckets, wide-open Firebase / Supabase rules, .env / .git exposure.

Threat-to-rule mapping is public at defen.so/threats.

Contributing

Bug in an SDK? Open an issue at https://github.com/1fancy/defen.so/issues. Include:

• The SDK + version
• Framework + version
• A minimal reproduction

Security disclosures: mail info@defen.so — please don't file public issues for security bugs.

Links

• Landing: https://defen.so
• App: https://app.defen.so
• MCP: https://mcp.defen.so
• Playground: https://playground.defen.so
• WordPress plugin: https://wordpress.org/plugins/defen-so-connector/
• Mobile app (Google Play): https://play.google.com/store/apps/details?id=so.defen.alerts
• Website monitor app: https://defen.so/website-monitor-app
• Free scanner: https://defen.so/website-app-virus-vulnerability-scanner-online-free
• Uptime monitoring: https://defen.so/website-apps-uptime-monitoring
• Docs: https://defen.so/docs
• Roadmap: https://defen.so/roadmap
• Blog: https://defen.so/blog
• Live CVE feed: https://defen.so/threats

License

MIT. See LICENSE.