Connect once. Then every visit is cleaned and every response is veiled.
Your DNS provider answers "where is your site?" with a NodPulse gateway. The gateway answers "who is visiting and what are they carrying?" and cleans it before your origin ever sees it.
One A record, or one outbound agent
Shield: point your domain's A record at the gateway we assign and keep your origin where it is. EchoNod and up: install the NodPulse agent on your origin. It dials out to the gateway and holds the connection open, so you close every inbound port and take your origin's address out of DNS. The gateway is the only public address.
The strip-pass runs on every request
Tracking query parameters (utm_*, fbclid, gclid, msclkid and more) are dropped. Tracker cookies are removed from the Cookie header; your own session cookies pass. Cross-site referrers are reduced to their origin. High-entropy fingerprint client-hint headers are dropped while user preferences like DNT are kept. Malformed request shapes are rejected.
Every response leaves veiled
Server, X-Powered-By, Via, cache and platform headers that fingerprint your stack are stripped and every response says Server: NodPulse, with headers in a fixed order. Set-Cookie lines that plant tracker cookies are dropped. The body streams through untouched.
GateNod: no single relay carries a whole request
On GateNod, each request is split across three blind relays between the gateway and your origin, so no single relay ever holds a whole request. Same agent, same one A record, same cleaning — with the path itself broken up.