MODULAR LICENSING
Build the protection stack
your team needs.
Observation, detection and mitigation have separate responsibilities. Each deployment can license the control plane alone, add detection, or add the mitigation workflow under a written agreement.
Control plane
Host and HTTP telemetry, retained evidence, user roles, node inventory, audit and native clients. The control plane remains useful when no attack detector or mitigation module is enabled.
Detector
Classifies HTTP attack patterns, crawler identity and unusual workload pressure from measured evidence. It produces incidents and explanations; it cannot write Nginx configuration or block clients.
Mitigator
Reviews bounded actions, owns the Nginx overlay, verifies the active generation, expires temporary rules and records outcomes. Manual protection can be licensed independently of automated detection. Automatic changes require both modules and an explicit policy.
A 429, 444, 499 or 504 response alone is not proof that Hostwatch blocked an attack. Verified mitigation is attributed only when the active rule and the request evidence match.