Web Firewall quickstart
Open Projects → your project → Security. The Web Firewall toggle is available for a deployed static site or container project. It is not a separate account-wide dashboard section, and custom serverless agents do not have this control. Review the security rates shown in the dashboard and on Pricing before enabling. The shared access fee applies once when either security product is on; product and custom-rule fees are prorated, with request usage billed separately.
Enable the firewall
Turn on Web Firewall, then choose whether to enable Managed baseline rules. The baseline checks common threats and bad inputs. Changes do not rebuild your app, but can take time to propagate.
Add an allow or block rule
Select Add rule, choose a name and action, then fill in one or more matchers:
- Path: a substring, such as
/admin.*is not a wildcard. - Method: the HTTP method, such as
POST. - IP ranges: IPv4 CIDRs, such as
203.0.113.0/24; use/32for one address. - Countries: two-letter country codes.
- Header: a header name and a value substring.
All populated fields must match. Save up to 25 custom rules. Their displayed order is their evaluation order. Enabled managed protections run first; a custom allow cannot bypass an earlier managed block. An allow does skip later custom rules and the rate-limit rule, so use it narrowly.
Configure the rate limit
The separate Rate limit field sets a project-wide per-IP limit over five minutes, from 100 to 2,000,000 requests. Leave it blank and save to disable it. It is not a per-path or per-country custom-rule action.
Check results
Matched requests reports aggregated blocked, allowed, and counted totals by rule over 1 hour, 6 hours, 24 hours, or 7 days. Refresh to request updated metrics. There is no individual request log in this panel. Test intended visitors and API clients after rule changes.
See Bot Protection for common-bot filtering.