How codexeron/web-site-guard works
Web Site Guard is a FastAPI web-protection service. Its documented request workflow checks whitelist/blacklist, rate limits, bot signatures, WAF rules and login lockouts before forwarding accepted requests; responses receive security headers. Login records attempts and issues CSRF tokens, while honeypot hits are logged and trigger an IP block. The sampled middleware does not invoke geo blocking or CSRF validation. The README also describes upload scanning, TLS monitoring, anomaly detection, and broader logging/admin features, but their implementation files are absent from the supplied tree; those branches are shown without inferred wiring.
Main entry points: main.py FastAPI app · database.py Connection pool · database.sql PostgreSQL · waf.py WAF scanning
Components 19
Request protection
- FastAPI app
main.py - IP lists
ip_manager.py - Rate limiter
rate_limiter.py - Bot detection
bot_guard.py - WAF scanning
waf.py - Security headers
headers_guard.py - Geo rules
geo_guard.py
Identity and traps
- Login protection
bruteforce.py - CSRF tokens
csrf.py - Honeypot endpoint
main.py
Data and configuration
- PostgreSQL
database.sql - Connection pool
database.py - Runtime config
config.py
Additional protections
- Upload scanning
- TLS monitoring
- Anomaly detection
- Request and audit logs
Other components
- HTTP client
- Protected application
Connections 32
- HTTP client → FastAPI app: sends HTTP
- FastAPI app → IP lists: checks lists
- FastAPI app → Rate limiter: checks limit
- FastAPI app → Bot detection: checks agent
- FastAPI app → WAF scanning: scans payload
- FastAPI app → Login protection: checks lockout
- FastAPI app → Protected application: forwards request
- FastAPI app → Security headers: applies headers
- FastAPI app → Login protection: records login
- FastAPI app → CSRF tokens: issues token
- FastAPI app → Honeypot endpoint: serves route
- FastAPI app → Geo rules: loads rules
- FastAPI app → Connection pool: opens pool
- IP lists → Connection pool: gets connection
- Rate limiter → Connection pool: gets connection
- Bot detection → Connection pool: loads signatures
- WAF scanning → Connection pool: loads rules
- WAF scanning → Connection pool: writes threats
- Login protection → Connection pool: reads and writes
- CSRF tokens → Connection pool: reads and writes
- Geo rules → Connection pool: loads rules
- Honeypot endpoint → Connection pool: gets connection
- Connection pool → PostgreSQL: queries
- IP lists → PostgreSQL: reads and writes lists
- Rate limiter → PostgreSQL: updates counters
- Bot detection → PostgreSQL: reads signatures
- WAF scanning → PostgreSQL: reads rules and writes events
- Login protection → PostgreSQL: reads attempts
- CSRF tokens → PostgreSQL: stores tokens
- Geo rules → PostgreSQL: reads rules
- Honeypot endpoint → PostgreSQL: writes hits
- Runtime config → Connection pool: provides settings