FloodFighter

Fingerprint-based request-flood blocking for small SaaS sites without a security team

Problem

Small sites are constantly hit by loops of form submissions and mass signups, and captchas no longer work, yet founders have no budget for a security team or an enterprise WAF.

Solution

A lightweight reverse-proxy or middleware service that scores requests by IP, behavioral fingerprint, submission cadence, and signup patterns, then applies JS challenges, rate limits, or soft bans to suspicious traffic. A simple dashboard shows every blocked request and false positives, with one-click rule tuning.

Users

Indie developers, small SaaS teams, small e-commerce and form-heavy site operators

MVP

SDK/middleware hooked into form and signup endpoints; frequency and behavior scoring rules; JS challenge and rate-limit policies; suspicious-request log with a false-positive allowlist; daily blocked-requests email digest

Revenue

Monthly per-site subscription (free tier, then $9–29/month) tiered by request volume

Why now

AI has made spam and mass registration nearly free, weakening captchas, while small sites still lack an affordable alternative; the stack is simple enough to build solo