Protection

Semantic engine, custom rules, IP and geo, bot challenges, rate limits, ACL, and block pages.

Global defaults live under protection and protection.policy. A site can overlay sites[].waf.protection_policy.

Console pages: Protection, Rules, IP, Bot challenge, Block pages.

Decode, AST, per-engine switches.

Regex rules on URI and other locations.

Allow lists, deny lists, GeoIP, threat intel.

JS challenge, slider, PoW, image, waiting room.

Token bucket and waiting room.

Method, path, and header denies.

Templates and custom HTML.

Semantic engine

Multi-stage decoding and AST checks. Toggle engines per site.

Regular-expression rules on URI and other locations, with priority and severity.

Allow lists, deny lists, GeoIP, reputation overrides, and threat-intel feeds.

JS clearance, PoW, slider, image CAPTCHA, login CAPTCHA, and the waiting room.

Token-bucket limits on the data plane. API-specific limits live under apisec.

Deny or allow by HTTP method, path prefix, and header.

Built-in templates, custom HTML, and a preview window.