RouteWardenHigh-Performance Edge Defense for Traefik, Caddy & NGINX

What is RouteWarden? ​

RouteWarden is a security middleware for Traefik, Caddy, and NGINX / OpenResty. It runs at your edge router or ingress controller, evaluating inbound requests and blocking reconnaissance scans before they reach backend application containers.

Internet-connected servers receive continuous automated scans looking for .env files, .git trees, database dumps, backup archives, and administrative interfaces. RouteWarden matches these attempts at the proxy level and responds according to your configuration.

Request Inspection Lifecycle ​

RouteWarden evaluates inbound HTTP requests in five stages:

Default Protection Rules ​

With enableDefaultPatterns: true active, RouteWarden blocks common exposure paths without requiring custom rules:

Anti-Evasion Normalization ​

Attackers often obfuscate request paths to bypass string matching. RouteWarden normalizes paths before evaluation:

Response Modes ​

When a path matches a block rule, RouteWarden can respond with:

• json: Structured JSON payload with customizable status code and body.
• html: Custom HTML error page.
• text: Plain text error message.
• xml: XML-formatted error document.
• captcha: Human challenge verification using Cloudflare Turnstile, hCaptcha, or Google reCAPTCHA.
• redirect: HTTP redirect to an external sink or notice page.
• silentDrop: Immediate TCP connection closure.
• gzipBomb: Returns a compressed gzip payload that expands in client memory.
• tarpit: Delivers bytes slowly to hold client connections open.
• fakeSuccess: Decoy response returning synthetic data with a 200 OK.
• rateLimitChallenge: Returns HTTP 429 with a standard Retry-After header.
• proxy: Forwards matching traffic to an internal inspection or canary service.
• infiniteStream: Continuous stream of pseudorandom data.

30-Second Setup ​

Get protected in seconds with your preferred gateway:

services:
  traefik:
    image: traefik:v3.3
    command:
      - "--experimental.plugins.routewarden.modulename=github.com/routewarden/traefik-warden"
      - "--experimental.plugins.routewarden.version=v1.2.1"
      - "--providers.docker=true"
      - "--entrypoints.web.address=:80"
      - "--entrypoints.web.http.middlewares=warden@docker"
    ports:
      - "80:80"
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    labels:
      - "traefik.enable=true"
      # Global EntryPoint Shield: protects ALL services automatically
      - "traefik.http.middlewares.warden.plugin.routewarden.enabled=true"
      - "traefik.http.middlewares.warden.plugin.routewarden.enableDefaultPatterns=true"

  webapp:
    image: nginx:alpine
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.app.rule=PathPrefix(`/`)"
      - "traefik.http.routers.app.entrypoints=web"

Production Case Studies ​

Real-world deployment patterns demonstrating how engineering teams and self-hosters protect their applications using RouteWarden:

Ready to Explore? ​

• Deploy on Traefik Proxy with our step-by-step setup guides and Docker Compose templates.
• Deploy on Caddy Web Server with native Caddyfile directives and xcaddy builds.
• Deploy on NGINX & OpenResty with in-memory Lua inspection.
• Use the RouteWarden CLI (rwarden) to test paths offline, validate configs, and generate gateway files.
• Learn about the Core System Architecture and Anti-Evasion Engine.
• Browse real-world recipes in the Cookbook & Case Studies.