Command-line client (CLI)

webshield is the official command-line client for the WebShield API. It manages domains and DNS records, edge settings of proxied hosts, publishes static sites (including incremental publishing from CI), and shows statistics and billing usage.

Source code and releases: github.com/webshieldpro/webshield-cli.

Installation

The installer detects your OS and architecture, downloads the latest release, verifies the SHA-256 checksum and installs the binary to ~/.local/bin:

curl -fsSL https://raw.githubusercontent.com/webshieldpro/webshield-cli/main/install.sh | sh

Prebuilt binaries are available for Linux (x86_64, aarch64 — static, no dependencies) and Windows on the releases page. You can also build from source with Rust:

git clone https://github.com/webshieldpro/webshield-cli
cd webshield-cli
cargo build --release
mv target/release/webshield ~/.local/bin/

Shell completion

Each release archive ships completion scripts; the binary can also generate them for bash, zsh, fish, PowerShell, elvish and nushell:

# bash
webshield completion bash > ~/.local/share/bash-completion/completions/webshield
# zsh (the target dir must be on $fpath)
webshield completion zsh > ~/.zfunc/_webshield
# fish
webshield completion fish > ~/.config/fish/completions/webshield.fish

Authentication

The CLI uses a personal API token (wsk_…). Create one in the control panel under Settings → API tokens with the scopes you need — see API tokens. For CI, prefer a narrow token bound to a single domain or site.

webshield auth login          # prompts for the token and saves it to a profile
webshield auth status         # shows the active profile and verifies access

Alternative ways to pass the token: the --token flag or the WS_TOKEN environment variable (convenient in CI). Profiles are stored in ~/.config/webshield/config.toml; several profiles are supported via --profile (or WS_PROFILE), like in aws or gh.

Domains

webshield domains list                     # your domains and delegation status
webshield domains add example.com          # add a domain (imports existing records by scanning)
webshield domains add example.com --import none
webshield domains check example.com        # check delegation to WebShield nameservers
webshield domains remove example.com

Names without changing nameservers

The domain stays at your DNS provider, and names are connected with records (details in Connect without changing nameservers):

webshield domains add example.com --external
webshield hosts add www.example.com --domain example.com --origin 203.0.113.10   # prints the records
webshield hosts verify www.example.com     # after the _acme-challenge record: confirmation and certificate
webshield hosts list                       # status, certificate, whether traffic flows through us
webshield hosts records www.example.com    # the records again
webshield hosts add blog.example.com --domain example.com --mode static
webshield proxy set www.example.com --domain example.com --origin 203.0.113.20  # change the server
webshield hosts remove www.example.com

DNS records

webshield dns list example.com
webshield dns list example.com --type A

webshield dns add example.com www A 203.0.113.10       # add a value to the set
webshield dns set example.com @ A 203.0.113.10         # make the set exactly this value
webshield dns remove example.com www A 203.0.113.10    # remove a single value
webshield dns remove example.com www TXT                # remove the whole record set

webshield dns add example.com www CNAME foo.example.com # trailing dot added automatically
webshield dns add example.com @ MX "10 mail.example.com" --ttl 3600

Semantics for multi-value types (A, AAAA, TXT, MX): add appends values to the existing set, set makes the set exactly the given values, remove deletes only the listed values (without values — the whole set). CNAME/NS are single-valued and always replaced.

webshield dns dnssec status example.com    # DS records for the registrar
webshield dns dnssec enable example.com
webshield dns dnssec disable example.com   # blocked while a DS is live in the parent zone

See DNSSEC for the delegation-side steps.

Static sites

webshield sites list
webshield sites create www.example.com --domain example.com
webshield sites publish www.example.com --dir ./public            # incremental publish
webshield sites publish --site-id 6 --dir ./public                # by id (narrow sites:publish tokens)
webshield sites publish www.example.com --dir ./public --dry-run  # show the plan only
webshield sites publish-from-bucket www.example.com --bucket web --path public/  # from your S3 bucket
webshield sites files www.example.com

publish-from-bucket publishes the site straight from one of your own object-storage buckets (upload it there with any S3 tool first). The command starts the async publish and waits until it finishes.

publish computes a stateless diff against the server (by content hash), uploads only changed files, deletes vanished ones and atomically publishes a new version — safe to run from CI on every build.

A minimal GitHub Actions (Gitea Actions, Forgejo Actions) step:

- name: Publish site
  env:
    WS_TOKEN: ${{ secrets.WS_PUBLISH_TOKEN }}
  run: |
    curl -fsSL https://raw.githubusercontent.com/webshieldpro/webshield-cli/main/install.sh | sh
    ~/.local/bin/webshield sites publish www.example.com --dir ./public

The same job for GitLab CI (WS_TOKEN is a CI/CD variable with Masked and Protected ticked):

publish:
  script:
    - curl -fsSL https://raw.githubusercontent.com/webshieldpro/webshield-cli/main/install.sh | sh
    - ~/.local/bin/webshield sites publish www.example.com --dir ./public

More on hosting modes and CI tokens — Hosting static sites.

Proxied hosts and redirects

webshield proxy list
webshield proxy get app.example.com
webshield proxy set app.example.com --domain example.com --ssl true --bot-protection true
webshield proxy set old.example.com --domain example.com \
    --mode redirect --redirect-target example.com
webshield proxy set shop.example.com --domain example.com --html-cache true
webshield proxy purge-cache app.example.com
webshield proxy remove app.example.com

proxy set creates the host config or partially updates an existing one; boolean flags are sent only when specified, other settings stay untouched.

purge-cache drops everything we cached for the host — handy at the end of a deploy if files changed under the same names. See CDN and protection for details.

Statistics and billing

webshield stats summary example.com --range 7d   # traffic/requests summary
webshield stats bans example.com                 # active bans and challenges

webshield billing balance
webshield billing usage example.com              # traffic vs the plan limit
webshield billing tariffs example.com

Scripting

Every command supports machine-readable output:

webshield -o json domains list | jq -r '.[].name'

Interface language is selected with --lang en|ru (or WS_LANG); by default it follows the system locale. --yes skips confirmation prompts for destructive operations.