# Protection

> Semantic engine, custom rules, IP and geo, bot challenges, rate limits, ACL, and block pages.

---

LLMS index: [llms.txt](/llms.txt)

---

Global defaults live under `protection` and `protection.policy`.
A site can overlay `sites[].waf.protection_policy`.

Console pages: **Protection**, **Rules**, **IP**, **Bot challenge**, **Block pages**.

<div id="td-nav-cards-30c14bd3a0618145edc279b0c7b7022d-0" class="td-content-cards" style="--td-card-columns: 2">
<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-0" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/semantic/">Semantic engine</a></div><p class="td-content-card__description">Decode, AST, per-engine switches.</p>
  </div>
</article>

<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-1" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/custom-rules/">Custom rules</a></div><p class="td-content-card__description">Regex rules on URI and other locations.</p>
  </div>
</article>

<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-2" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/ip-geo-fingerprint/">IP, geo, fingerprint</a></div><p class="td-content-card__description">Allow lists, deny lists, GeoIP, threat intel.</p>
  </div>
</article>

<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-3" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/bot-captcha/">Bot and CAPTCHA</a></div><p class="td-content-card__description">JS challenge, slider, PoW, image, waiting room.</p>
  </div>
</article>

<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-4" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/ratelimit/">Rate limit</a></div><p class="td-content-card__description">Token bucket and waiting room.</p>
  </div>
</article>

<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-5" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/acl/">ACL</a></div><p class="td-content-card__description">Method, path, and header denies.</p>
  </div>
</article>

<article id="td-nav-card-30c14bd3a0618145edc279b0c7b7022d-nav-cards-0-6" class="td-content-card">
  <div class="td-content-card__body">
    <div class="td-content-card__head"><a class="td-content-card__title" href="/docs/cheesewaf/protection/block-page/">Block pages</a></div><p class="td-content-card__description">Templates and custom HTML.</p>
  </div>
</article>

</div>

---

Section pages:

- [Semantic engine](/docs/cheesewaf/protection/semantic/): Multi-stage decoding and AST checks. Toggle engines per site.
- [Custom rules](/docs/cheesewaf/protection/custom-rules/): Regular-expression rules on URI and other locations, with priority and severity.
- [IP, geo, and fingerprint](/docs/cheesewaf/protection/ip-geo-fingerprint/): Allow lists, deny lists, GeoIP, reputation overrides, and threat-intel feeds.
- [Bot challenge and CAPTCHA](/docs/cheesewaf/protection/bot-captcha/): JS clearance, PoW, slider, image CAPTCHA, login CAPTCHA, and the waiting room.
- [Rate limit](/docs/cheesewaf/protection/ratelimit/): Token-bucket limits on the data plane. API-specific limits live under apisec.
- [ACL](/docs/cheesewaf/protection/acl/): Deny or allow by HTTP method, path prefix, and header.
- [Block pages](/docs/cheesewaf/protection/block-page/): Built-in templates, custom HTML, and a preview window.