Protection rules¶

Rules are evaluated top to bottom per request; the first match wins. Build them in the portal's rule editor and order them by drag and drop.

Match¶

Key	Example
`path`	`/admin`, `/api/v1/`, `/status.php`
`path_class`	`auth`, `admin` (built-in path groups)
`geo`	list of country codes, `[IN, RU]`
`ip`	addresses or CIDRs
`asn`	autonomous system numbers
`ja4`	TLS fingerprints

match_mode combines several keys with and or or; negate inverts the match.

Actions¶

Action	Effect
`allow`	pass, and skip the proof-of-work challenge (use for API clients and monitoring)
`deny`	`403`
`challenge`	proof-of-work challenge
`rate`	limit to `threshold` requests per `window` (for example 10 per 10 s), then challenge

Defense posture¶

The standard posture adds default rules: authentication paths are limited to 10 requests per 10 s and admin paths to 20 per 10 s, both with a challenge above the limit. Threat intelligence lists (abuse sources, Tor exits) can be set to log, challenge or deny.

Example: allow an API prefix for machine clients, challenge one country, deny an ASN.

- match: {path: "/api/*"}       action: allow
- match: {geo: [IN]}            action: challenge
- match: {asn: [64496]}         action: deny