Digital sovereignty · made in Italy
Secure web apps and services: opens the door only to those who belong.
Gate443 is the digital doorman of your web applications: it stands in front of the service and, before the page even opens, checks who is knocking and where from. It is one more layer of security: it adds to your application's login, it does not replace it.
- Designed and built in Italy
- Hosted in Italian data centres
- Data and records under your control
A MiriuM product, an Italian software house: developed, hosted and supported in Italy.
In plain words
How Gate443 works, in three steps
Whoever needs to get in installs nothing and has no new passwords to remember: they prove who they are and the gate opens. Then they use the application as they always have.
Asks to enter
The user opens the service's address and types their email. That's all.
Proves who they are
They get a six-digit code by email and type it in the same page. The code is always needed. If you decided that this user may only sign in from certain networks, for example the office, other networks won't let them in.
Reaches the application
The code works only in that page and on that connection: if someone forwards or intercepts it, it won't work anywhere else. From there the user works in the application as usual, its own login included if it has one.
Why it pays off
More security for your web apps, fewer headaches
The practical benefits, without the jargon.
Adds to, doesn't replace
Gate443 does not take the place of your application's authentication: it shields it, so unauthorised people never even reach the login page.
Only those you authorise get in
You decide who can access what. Whoever is not on the list never even reaches the page.
Stays on your domain
Your sites keep living at your own address, with your logo and your colours. The HTTPS padlock switches on by itself.
Everything tracked
You always know who got in, when and from where. Useful for audits and for meeting regulations.
Want the details? Keep scrolling.
From here we explain how it works in detail: recognising users, addresses and domains, request filtering and the access log. Where a technical term is needed, we explain it.
Identity
An identity check in front of your web application
Gate443 does not replace the protected service's authentication: it decides who may access it. First you enable the user; then, at every sign-in, the user is recognised with a one-time code, a passkey or an authenticator app, and only then gets in.
Access code by email
The user types their email and gets a six-digit code. The code can be used once, expires after 5 minutes and works only in the page it was requested from and from the same connection. The email has no link to click: so no mail program can open the access in the user's place.
Passkey & Windows Hello
For administrators: sign in with your fingerprint, your face, Windows Hello or a security key. No password to type, so nothing to steal.
Two-step check for the panel
To enter the administration panel, besides the password you always need a second proof: a code from an authenticator app (such as Google Authenticator) or, if you don't have the app, a code by email.
Access only from certain networks
For each user and service you can set which network addresses (IPs) may be used to sign in, for example your office's. The code by email is still needed: the address says where from one may enter, the code says who is entering. If you set no addresses, there is no limit.
Addresses and domains
Every service at an address of yours
Gate443 sits between your users and the protected service. The service can have an address of yours, with no technical parts in the middle, and the HTTPS padlock switches on and renews by itself.
An address for every service
The access page and the service sit at an address of yours, for example area.customer.com. Alternatively you can use a Gate443 address such as app.gate443.it/customer/service.
Automatic HTTPS
The security certificate (Let's Encrypt) switches on at the first visit and renews by itself. You only need to point your domain at Gate443 with a DNS record.
An access page with your brand
Every service has its own access page: colours, logo, background, icon, titles and links to privacy and cookies. You customise it yourself, service by service.
WordPress
Secure WordPress: the admin area closed to anyone not coming through Gate443
The WordPress login page (wp-login.php) is among the most attacked on the web. With Gate443 the site stays public and at the same address, while the admin area (wp-admin) opens only after the email code. You don't need to change WordPress and you don't need a VPN.
Admin area only, or the whole site
Your choice: a public site with the login and admin pages protected (wp-login.php, wp-admin, xmlrpc.php), or the whole site invisible without the code, handy for intranets and test sites. The list of protected pages can be changed.
Same address, no changes
The site stays at its address: Gate443 passes it to WordPress as it is, and WordPress notices nothing. No redirects to fix, no changes to the database or the configuration. That is why a WordPress service always uses a custom domain: at an address like app.gate443.it/customer/service the site would not work.
A ready-made plugin from the panel
From the panel you download a plugin already prepared for your service. It blocks anyone trying to reach the admin area without going through Gate443, and shows WordPress the visitor's real address and IP. It also works on shared hosting, where you have no firewall to configure.
Your own server: the rule in the web server
If the site runs on your own server (VPS), the technical guide — in the panel, after signing in — gives you ready-made rules for nginx and Apache, with Gate443's addresses to allow. Request filtering and the limit on attempts protect the public site too.
Request filter (WAF)
Every request goes through a filter
Before reaching the service, every request is checked by an application firewall (WAF). Anyone sending too many requests in a short time is stopped and blocked for a while. You can also list addresses and countries to always let through or to block; the country is worked out without asking external services. The rules apply in this order:
Privacy and control
Useful logs, respectfully kept
Every customer company has its own services, users and administrators, kept apart from everyone else's. And it decides how to handle its own access records.
Keep records as long as you choose
Every customer chooses how many days to keep access records; after that they are deleted automatically.
Anonymous IP addresses
IP addresses can be made anonymous, by hiding their last part, immediately or after a number of days you choose. Whoever runs the platform always sees emails and IPs in anonymous form.
Two-level administration
Whoever runs the platform and whoever administers their own company have separate roles. Each sees only what concerns them.
Access log
Who got in, when, from which address and on which service. You can filter by date, action and customer, and export the data for audits.
What it costs
Work out your fee
Build the configuration you need: the fee for each 30-day period updates as you choose.
The applications you want to protect. The first service costs €29 and includes the platform; each extra service costs €14.
A WordPress site requires the custom domain: it has to answer at its own address and cannot work at app.gate443.it/customer/service. If you move this slider, the domains below update by themselves.
The people who sign in, counting all services: 50 included per service, then €10 for every extra 50.
The service uses an address of yours, with automatic HTTPS. €10 every 30 days each. Required for every WordPress site.
Amounts in Euro, taxes excluded
Free trial
7 days free, no credit card
Register your company, confirm your email and you immediately get a panel with one protected service and one custom domain, free for 7 days. Then it's up to you: if you choose how to pay (card or SEPA Direct Debit) you continue at list price, otherwise the services simply stop. If you come from a reseller's link, the trial lasts one extra month.
Frequently asked questions
The questions we always get
From the login you already have to setting up your server so it accepts only traffic coming through Gate443.
Does Gate443 replace my application's login?
No. Gate443 stands in front of the service and decides who may reach it; the application's login, if it has one, keeps working as always. Unauthorised people never even see the login page.
It is an extra layer, not a replacement: if you switched Gate443 off tomorrow, your application would stay protected as before, by its own login.
How do I stop people reaching my application without going through Gate443?
This is the step that makes the protection real: if your server answers anyone, whoever knows its address can go around the gate. The fix is to accept connections only from Gate443's addresses and refuse all others. There is more than one address, because if the main server stops a backup one takes over: all of them must be allowed.
The guide inside the panel has the ready-made lines to copy and paste, with the exact place to put them, for every tool:
- firewall (Linux, Windows, cloud);
- nginx and Plesk;
- Apache, cPanel and .htaccess;
- Caddy and IIS.
The same lines put the visitors' real IP in the logs. If you have a WordPress site on shared hosting and can't touch the server, there is the plugin: download it from the panel, upload it to WordPress and activate it.
What if Gate443's IP address changes?
Good question: an address written by hand into many configurations becomes a problem the day it changes. That's why filtering by address is not the only way.
- A name instead of the number. We give you a stable domain name that always points to Gate443: the firewall turns it into the right address by itself, with no work on your side.
- A shared secret. Gate443 adds a secret header to requests that only you and we know; the application refuses requests without it. It does not depend on addresses, so if they change you don't need to touch your servers.
- A private link. With a VPN or a dedicated connection, the application accepts only traffic coming from there: the public address no longer matters.
In any case we warn you beforehand, and for a while the old and new addresses work together: the service does not stop.
How does a user sign in?
They open the service's address, type their email and get a six-digit code to type in the same page. The email has no link to click: so the mail program cannot open the access in a browser other than the user's.
If you limited the networks this user may sign in from, the code arrives only when the request comes from an allowed network: from any other, access is refused before the email is even sent.
Do users have to install anything?
Nothing. A browser and an email inbox are all it takes. No programs to install, extensions to approve or new passwords to hand out and then revoke when someone leaves the company.
Can I keep my own domain?
Yes. With a custom domain the service uses an address of yours, for example area.company.com, with your access page, your logo and your colours. The HTTPS certificate switches on and renews by itself: you only need to point the domain at Gate443.
The emails with the code show your company name as the sender. If you also want the sender address to be on your domain, set in the service the mail server you already use: the mail then leaves from your domain and is less likely to end up in spam. You can also leave the address empty: we'll use the default mailbox on your domain.
Is the service still reachable without a dedicated domain?
Yes, you can use both addresses. Every service always has a Gate443 address of the form /customer/service, which keeps working even if you enable the custom domain: handy as a fallback while the new domain becomes active, or for anyone who has it bookmarked.
WordPress is the exception: a site has to answer at its own domain, so a WordPress service works only at the custom domain and the other address redirects there.
How much does protecting a WordPress site cost?
One service plus one custom domain: €39 + VAT every 30 days at list price (€29 the service, €10 the domain), or the contract's first service plus €10. Here the custom domain is not optional but required: WordPress creates links and redirects to its own domain, and at app.gate443.it/customer/service it would not work. In the calculator above you'll find it under Services with a custom domain.
What data do you log and for how long?
Who got in, when, from which address and on which service. You decide how many days to keep this data: after that, it is deleted automatically.
IP addresses can be made anonymous immediately or after a number of days you choose. Whoever runs the platform always sees the addresses in anonymous form.
What does the request filter (application firewall) block?
Every request is checked before it reaches the service. Anyone sending too many requests in a short time is stopped and, if they insist, blocked for a while. You can list addresses and countries to always let through or to block. The country is worked out without sending your visitors' data to external services.
The rules apply in this order: address lists first, then country lists, and finally the request limit.
How do renewals and payments work?
The service is paid in 30-day periods: the first starts the day after the trial ends, then it renews every 30 days. You can pay by card or SEPA Direct Debit, and 5 days before every payment you get a reminder by email. Prices exclude VAT: companies based in Italy are charged 22% Italian VAT on top. If you add something, you use it at once and pay for it from the next renewal; if you remove something, the reduction applies from the next renewal.
Nothing is recalculated backwards, and every change stays on record with its period and its amount.
The full terms (contract, price list, SLA and privacy) are in the legal notices (in Italian).
Ready to close the gate?
Put Gate443 in front of your web apps.
We'll show you in a demo how to protect an internal service in minutes: domain, access and rules, all from one panel.