Security Access Gateway
Opens the door
only to those who belong.
Gate443 is the digital doorman of your web applications: it stands in front of the service and, before the page even loads, checks who is knocking and where from. It is one more layer of protection, added to your application's login without replacing it.
In plain words
How it works, in three steps
Whoever needs to get in installs nothing and receives no new credentials from Gate443: they prove who they are and the gate opens. Then they use the application as they always have.
Asks to enter
The user opens your service's address and types their email. Nothing else.
Proves who they are
They receive a six-digit code by email and type it in the same window. The code is always required: if the mapping restricts network addresses, access is possible only from the allowed ones.
Reaches the application
The code works only in the window the request started from, and only from the same connection: forwarded or intercepted elsewhere, it opens nothing. From there on the application takes over, its own login included, if it has one.
Why it pays off
Fewer headaches, more security
The practical benefits, without the jargon.
Adds to, doesn't replace
Gate443 does not take the place of your application's authentication: it shields it, so unauthorised people never even reach the login page.
Only those you authorise get in
You decide who can access what. Whoever is not on the list never even reaches the page.
Stays on your domain
Your sites keep living at your own address, with your logo and your colours. The HTTPS padlock switches on by itself.
Everything tracked
You always know who got in, when and from where. Useful for control and compliance.
Want the details? Keep scrolling.
From here on we get into how it works: identity, reverse proxy, application firewall and log handling.
Identity
An identity check in front of the application
Gate443 issues no credentials for the protected service and does not replace its authentication: it decides who may reach it. The user proves who they are with a one-time code — always, and if the mapping restricts addresses, only from the allowed IPs — and is let through; the application, if it has its own login, keeps asking for it. Every step is bound to the source IP and logged.
Access code by email
The user enters their email and receives a six-digit, one-time code valid for 5 minutes, to be typed in the window it was requested from and from the same IP. No link to click: the mail client cannot hijack the access onto another browser.
Passkey & Windows Hello
For administrators: FIDO2 login with the device's biometrics or a security key. Nothing to type, nothing to steal.
2FA for the panel
Access to the administration always has a second factor: TOTP OTP with an authenticator app, or a backup code by email if you don't have the app.
IP restriction
On user–service mappings you can list the allowed addresses: that user, on that service, works only from those IPs. The code by email is still always required — the address says where from one may enter, the code says who is entering. Empty list, no restriction. Use it to tie an access to an office or a company network.
Reverse proxy
Every service on its own domain, white-label
Gate443 proxies the protected services and rewrites URLs: the site stays entirely under the customer's domain, with no technical segments. HTTPS certificates are issued and renewed on their own.
Dedicated domain per service
Login and protected site live at area.customer.com. Alternatively, a clean path URL /customer/service on the main domain.
Automatic HTTPS
Let's Encrypt certificates issued on first visit for every customer domain and renewed automatically. Just point the DNS.
Branded login per service
Every service has its own access page: colours, logo, background, favicon, titles and privacy/cookie links. The customer brands it themselves, service by service.
Static cache on disk
Images, CSS, JS and fonts of proxied services are served from the cache with a configurable space limit per service: faster browsing, less load on the origin.
WordPress
The WordPress back office, closed to anyone not coming through Gate443
wp-login.php is the most attacked door on the web. Gate443 sits in front of the site like a CDN: the same domain inside and out, the site stays public and wp-admin answers only after the email code, from the IP that asked for it. No change to WordPress, no VPN, no security plugin to keep updated.
Back office only, or the whole site
Pick the service type: a public site with wp-login.php, wp-admin and xmlrpc.php protected, or intranets and staging sites completely invisible without the code. The protected paths remain editable.
Same address, zero changes
The site domain becomes the white-label domain and Gate443 forwards the original Host: WordPress believes it is at its own address. No redirects, no search-replace in the database, no lines in wp-config.php. That is why a WordPress service always includes a white-label domain: a site cannot work at the path address /customer/service.
Plugin generated by the panel
A zip already compiled with the service's token and rules: it rejects anyone reaching the back office without going through the gateway and shows WordPress the visitor's real host, https and IP. Works on shared hosting too, where there is no firewall to configure.
VPS: the rule in the web server
For those with their own server, the guide provides the nginx and Apache rules PHP cannot touch, with the Gate443 IP to allow. Mini-WAF, rate limiting and static cache also cover the public site.
Mini-WAF · inbound filter
An application firewall on every request
Every request is filtered before it reaches the service: rate limit per IP, automatic temporary bans, lists of allowed or blocked addresses and countries (offline geolocation, no calls to external services). Rules apply in this order of precedence:
Privacy & governance
Useful logs, respectfully kept
Multi-tenant by design: every customer has its own services, users and administrators. And every customer decides how to handle its own logs.
Configurable retention
Every customer chooses how many days to keep access logs; beyond the threshold they are removed automatically.
IP anonymisation
IPs masked (to /24 or /48) immediately or after N days. The superadmin always sees emails and IPs anonymised.
Two-level administration
Superadmin for the platform; customer admins for their own company. Each sees only what concerns them.
Filterable access log
Who, when, from which IP, to which service. Filters by date, action, customer and compliant export.
What it costs
Work out your monthly fee
Build the configuration you need: the monthly fee updates as you choose.
The applications placed behind the gateway. The first includes the platform (€29), each additional one €14.
The people who sign in, across all services: 50 included per service, then €10 for every extra 50.
200 MB on disk per service: images, CSS, JS and fonts served from the cache. €5 per month each.
The service lives on your domain, with automatic HTTPS. €10 per month each. Required for every WordPress site: a site cannot work at the app.gate443.it/customer/service address, it has to answer at its own domain.
Amounts in euro. VAT included for purchases from Italy.
Free trial
7 days free, no credit card
Register your company, confirm your email and you immediately get a panel with one protected service, one white-label domain and one static cache, free for 7 days. Then it is up to you: add a card and continue at list price, otherwise the services simply stop. If you come from a reseller's link, the trial lasts one extra month.
Frequently asked questions
The ten questions we always get
From living alongside your existing login to configuring your web server so it accepts only Gate443.
Does Gate443 replace my application's login?
No, and that's not a minor detail. Gate443 stands in front of the service and decides who may reach it; the application's authentication, if any, keeps working as always. Unauthorised people never even reach the login page.
It is an extra layer, not a replacement: if you switched Gate443 off tomorrow, your application would stay protected exactly as before.
How do I stop my application from being reachable by bypassing Gate443?
This is the step that makes the protection real: as long as the origin answers anyone, whoever knows the real address can go around the gate. The rule is to accept connections only from Gate443's address, which we give you at activation, and refuse everything else.
nginx
server {
listen 443 ssl;
server_name internal.company.com;
location / {
allow 198.51.100.7; # Gate443's address
deny all;
proxy_pass http://127.0.0.1:8080;
}
}
Apache 2.4
<Location "/">
Require ip 198.51.100.7
</Location>
IIS — web.config
<system.webServer>
<security>
<ipSecurity allowUnlisted="false">
<add ipAddress="198.51.100.7" allowed="true" />
</ipSecurity>
</security>
</system.webServer>
Requires the IP and Domain Restrictions feature, which IIS does not install by default.
Caddy
internal.company.com {
@others not remote_ip 198.51.100.7
respond @others 403
reverse_proxy 127.0.0.1:8080
}
Firewall, if you'd rather stop them before the web server
# Linux, ufw ufw default deny incoming ufw allow from 198.51.100.7 to any port 443 proto tcp # Windows, PowerShell New-NetFirewallRule -DisplayName "Gate443 only" -Direction Inbound ` -LocalPort 443 -Protocol TCP -RemoteAddress 198.51.100.7 -Action Allow
The firewall filter is more solid, because a refused request never even reaches the application. The web-server filter is handier when you don't manage the network yourself.
What if Gate443's IP address changes?
It's the right objection: a hand-written list of addresses in ten different configurations becomes a problem the day the address changes. That's why IP filtering is not the only way.
- DNS name instead of the number. We give you a stable hostname that always points to the gateway: the firewall resolves the name and updates the list by itself, without you touching anything.
- Shared secret. Gate443 adds to forwarded requests a header only you and we know; the application refuses requests without it. It does not depend on addresses, so an infrastructure change needs no work on your servers.
- Dedicated tunnel. With a VPN or a private link the application accepts only traffic coming from the tunnel interface: the public address becomes irrelevant.
In any case we warn you beforehand, with a period during which old and new address stay valid together: no service window lost.
How does a user sign in?
They open the service's address, enter their email and receive a six-digit code to type in the same window. No link to click: the mail client cannot hijack the access onto a browser other than the one that made the request.
If the mapping restricts network addresses, the code is sent only when the request comes from an allowed IP: from any other, access is refused even before the email.
Do users have to install anything?
Nothing. A browser and an email inbox are all it takes. No agents to roll out, extensions to approve or new credentials to hand out and then revoke when someone leaves the company.
Can I keep my own domain?
Yes. With white-label the service lives at an address of yours, for example area.company.com, with your access page, your logo and your colours. The HTTPS certificate is issued and renewed automatically: just point the DNS.
The emails with the code also leave from a sender on your domain. For them to arrive, our servers must be authorised in the domain's SPF and DKIM records: a DNS change we walk you through.
Is the service still reachable without a dedicated domain?
Yes, the two addresses coexist. Every service always has a path URL of the form /customer/service, and if you enable the white-label domain that one keeps working: handy as a fallback address while DNS propagates, or for anyone with a bookmark.
The exception is WordPress: a site has to answer at its own domain, so a WordPress-type service lives only at the white-label domain and the path address redirects there.
How much does protecting a WordPress site cost?
One service plus one white-label domain: €39 per month at list price (€29 the service, €10 the domain), or the contract's first service plus €10. White-label is not an option but a requirement: WordPress generates links and redirects to its own domain, and at the app.gate443.it/customer/service address it could not work. The calculator above counts it under Services with a white-label domain.
What data do you log and for how long?
Who got in, when, from which address and to which service. You decide how many days to keep it: beyond the threshold the logs delete themselves.
IP addresses can be masked immediately or after a number of days you choose. Whoever administers the platform always sees the addresses in anonymised form.
What does the application firewall block?
Every request is filtered before reaching the service: rate limit per address, automatic temporary blocks for those who insist, lists of allowed or forbidden addresses and countries. Geolocation is offline, so no data about your visitors leaves for external services.
Rules apply in order of precedence: address lists first, then country lists, finally the rate limit.
What happens if I change configuration mid-month?
Billing always starts on the first day of the month: the days from activation to the end of the month are on us. When you add or remove services and options, the conditions in force stay valid until the end of the month and the new ones start the following month.
Nothing is recalculated backwards and every change stays on record, with its validity period and its amount.
Ready to close the gate?
Put Gate443 in front of your apps.
We'll show you in a demo how to protect an internal service in minutes: domain, access and rules, all from one panel.