Shield runs on every node and watches who knocks. Anyone misbehaving is challenged or blocked right there, without reaching your server and without eating your traffic.
Someone who looks suspicious is not turned away: they get a page that resolves itself in about a second, then browse normally for twelve hours. A real visitor barely notices; a script stops there.
You can block or challenge an address, a whole network or a country, for as long as you decide. Networks that are too wide cannot be blocked by mistake: past a certain size the panel refuses.
Your own server is always let through, and Googlebot and Bingbot are recognised from their official networks rather than the name they claim: a bot posing as Google does not get in.
One switch, and every visitor goes through the challenge. While it is on, the site is served only from the nodes whose provider filters network attacks: the others leave the DNS in under a minute and come back as soon as you switch it off.
Keep it on during an attack and off the rest of the time: it also stops social previews, feed readers and monitoring services.
Every decision — who, when, why, for how long, on which nodes — goes into the log, and you can revoke it at any time. If a customer tells you they cannot open your site, thirty seconds is enough to know whether it was us.
Shield filters abuse and application-layer attacks, the ones made of requests that look real. Volumetric network attacks are filtered by the infrastructure providers, before they even reach our nodes. What nobody can promise is that nothing ever gets through: we tell you beforehand how far we go.