One line of code. Ten SDKs. Any stack.
Add Defenso to your app in seconds and the managed firewall and rate limits turn on right away. Node, Python, PHP, Go, Ruby and more, with no config file, no signatures to maintain, and it always fails open.
- Ten framework SDKs
- Firewall on instantly
- Fails open by design
- ~4ms per request
One line of code, and the security layer is live.
Most security tools ask you to change DNS, run an agent, or route traffic through a proxy before you get any protection. The Defenso SDK does none of that. You install one package, add one line to your app, and requests are inspected in-process before they reach your routes: a managed WAF, rate limiting and bot detection, with no infrastructure to stand up. This page is how the install works and why it stays out of your way.
Wires into the framework you already use.
The SDK plugs into your app's middleware layer, so there is nothing new to learn. The security policy streams from Defenso and stays current on its own, so you never touch a rule. Run one command to auto-detect your framework and wire it, or drop in a few lines yourself.
Run npx @defen.so/init and it detects your framework, installs the right SDK and wires the middleware in the correct file. Or copy the snippet for your stack and add it by hand, whatever you prefer.
If Defenso is ever unreachable, every request is allowed through and your app keeps serving. Your app keeps serving the whole time; only our live policy updates pause until we are back. It adds about four milliseconds per request.
Node and Next.js, Python for FastAPI, Django and Flask, PHP for Laravel and Symfony, Go, Ruby on Rails, and edge middleware for Vercel and Cloudflare Workers. Same one-line idea in every one.
A security SDK that respects your app.
The fastest path is one command: npx @defen.so/init detects your framework, installs the right SDK, wires the middleware into the correct file, and writes a DEFENSO_TOKEN stub to your .env. It knows each framework's convention (Next.js middleware, Laravel bootstrap, FastAPI add_middleware, Express app.use, Rails, chi, gin, axum, Spring, ASP.NET) so you do not hand-edit boilerplate. Ten runtimes are covered: Node, Bun, Deno, PHP, Python, Go, Ruby, Rust, Java and .NET.
The SDK runs inside your application, so a check adds roughly 4 milliseconds and there is no proxy hop, no DNS cutover and no agent to keep alive. It inspects each request against managed WAF rules, applies per-route and per-IP rate limits, and flags bots, then either allows, blocks or deceives, and streams the verdict to your dashboard. You add code, not infrastructure.
Every Defenso SDK fails open. If the Defenso API is ever unreachable, the SDK allows the request and your app keeps serving traffic. You lose protection during our incident, never availability. That is the deliberate design: security should never become the single point of failure that takes your site down. A 24-hour policy cache keeps rules working through brief network blips.
Frequently asked questions.
Everything people ask before they start. Still unsure? We are one message away.
Run npx @defen.so/init in your project. It detects the framework, installs the matching SDK, wires the middleware into the correct file, and adds a DEFENSO_TOKEN stub to your .env. Then paste your token from app.defen.so/developer. If you prefer to see the diff first, each language has a one-line manual snippet in the docs.
Ten languages: Node, PHP, Python, Go, Ruby, Rust, Java and .NET, with framework-aware wiring for Next.js, Nuxt, SvelteKit, Astro, Express, Fastify, FastAPI, Django, Laravel, Symfony, Rails, chi, gin, axum, Spring and ASP.NET. The CLI installs the right package and wires it the way each framework expects.
No. The SDK runs in-process inside your app, so there is no DNS cutover, no proxy hop and no agent to install. A request check adds about 4 milliseconds. Paid plans (Pro and up) can optionally add a CNAME edge WAF for no-code protection, but the SDK path needs no infrastructure changes.
The SDK fails open: if our API is unreachable, it allows the request and your app keeps serving traffic. You lose protection during the incident, not availability. A 24-hour policy cache also keeps rules working through short network blips, so security is never a single point of failure for your site.
The installer writes a DEFENSO_TOKEN placeholder to your .env; you copy the real token from app.defen.so/developer and paste it in. The token is read from the environment at runtime and is never hard-coded, so it stays out of your source and your commits.
Add security in one line.
Free to start, no card needed. Grab your token, run the command, and the managed firewall is live.