Skip to content

Emergency actions

Action What happens
Block source IPs, ranges or fingerprints are blocked; the edges pull the change immediately, enforcement within seconds
Maintenance mode the edge serves a branded maintenance page instead of contacting the origin
Lockdown always_challenge puts every request behind the proof-of-work challenge
Auto mitigation (beta) off by default; when enabled, the platform may apply a time-limited challenge itself, see below

Every change is written to the audit log with timestamp, user and diff. Normal configuration changes reach all edges in about 30 seconds.

During a volumetric attack, Layer 3/4 mitigation via BGP Flowspec is applied at the network edge within seconds; the Layer 7 stages are always on.

Auto mitigation (beta)

Off by default. When you enable it for a service, the platform is allowed to act on an attack without waiting for an operator. It is a closed loop:

  1. Trigger: the origin is in distress. Signals are relative to the service's own baseline: latency at 3× baseline together with at least 5 % errors, connection or response errors from the origin, or a request surge of 5× baseline. Edge load alone does not trigger it.
  2. Attribute: the edge logs are analysed for the dominant source: JA4 fingerprint, country, ASN.
  3. Act: the only automatic action is a proof-of-work challenge on the dominant JA4 fingerprint. It is written as a protection rule with a TTL, committed to the audit log and live on all edges within about 30 seconds. Blocking a country or an ASN is never automatic; it is proposed to our operators as a one-click suggestion.
  4. Verify: after five minutes the signals are checked again. If the challenge did not help, it escalates to a block of the same fingerprint. If it helped, the rule expires with its TTL and is reverted automatically.

Sources listed in the service's protection allowlist (countries, ASNs, IP ranges) are never touched by automation. With auto mitigation off, the same analysis runs but only produces a suggestion and a ticket. The allow rules of the service are honoured in both modes.