A system performs threat protection for real-time communications (“RTC”). The system receives, by a signaling engine of a gateway, a request of a client according to a protocol, where the request has successfully traversed one or more security devices between the client and the gateway. The system determines, by a protocol handler corresponding to the protocol, whether the request includes a threat. When the request includes the threat, the system indicates the threat to the one or more security devices, and when the request does not include the threat, the system sends the request to an application server at the gateway.