What each protection does

Each site has a Security tab in the portal with all of this. What a plan includes is on the pricing page.

Monitor or protect

A site either protects (stops what the protections catch) or only monitors (records what it would have stopped, and lets everything through). New sites protect; monitor mode helps when you want to see first what would happen.

Attack signatures

Recognise common attacks in the address, parameters, cookies and headers: SQL injection, cross-site scripting, path traversal and file inclusion, command and code injection, probes for sensitive files, and vulnerability scanners. Sensitivity (low, medium, high) sets how cautious they are; medium suits most sites. If a signature stops something legitimate, add an exception: for the whole site, under a path, for some addresses, or ignoring some parameters or cookies. Every plan.

Reputation lists

Requests from lists of hijacked and criminal networks, and from addresses that have just attacked any site we protect (for 24 hours after their last attack), are stopped on every site. Paid plans can set exceptions for addresses the lists shouldn't hold against your site. Your own rules can use the lists too, including the list of Tor exit nodes.

Your own rules

A rule matches requests by IP address or network, country, network operator (AS number), method, path, query, browser (user agent), a header, the connection's fingerprint (JA4) or a reputation list, and blocks, allows, logs or challenges them. Before saving, the form shows how many of the last 7 days' requests the rule would have matched. Free has 3 rules a site, paid plans 50.

Rate limits

Limit how many requests a client (an address, an address and path, a fingerprint, and more) may send in a time window, with a burst allowance; over the limit, the client is blocked or challenged for a while. Paid plans, 20 a site.

The browser check

Instead of a captcha, the browser solves a short task by itself (about a second on a phone) and gets a pass for 24 hours. Search engines' verified crawlers aren't checked; requests that aren't pages (images, scripts, APIs) get a refusal instead of the check page, since they can't solve it. Rules, rate limits and the under-attack switch can use it.

Under attack

The under-attack switch puts the browser check in front of every visitor of the site, for 1, 6 or 24 hours or until you switch it off; we email you when it ends by itself. Before switching it on, add allowing rules for webhooks, APIs and feeds, which can't solve the check. Every plan.

Unusual traffic

We learn each site's normal traffic for every weekday and hour. When a part of the traffic (a country, a network, a browser, a path) jumps far above normal, paid plans challenge that part automatically until it calms down; Free gets an email. You can end a challenge early or switch automatic challenges off.

The bot model

A model scores how much each client behaves like a bot. On paid plans it can challenge the clients it's sure about; on Free it only scores. It can be switched off, set to score only, or to challenge.

Alerts

Emails about your sites: your server's certificate failing our check or expiring soon, a certificate we can't get for a domain name, a domain name whose DNS no longer points to us, unusual traffic on a Free site, and the under-attack switch ending by itself. You can switch each one off under Account.