Web Firewall

Web Firewall in your dashboard

Manage a deployed project’s firewall in Projects → your project → Security. Combine a managed baseline, custom allow/block rules, and a separate per-IP request limit.

Get started Read the guide

// 01 — waf

Match requests you want to control.

Add an allow or block rule using a path substring, HTTP method, IPv4 range, country, or request header. Multiple fields in one rule must all match. Custom rules run in their saved order, after enabled managed protections.

+ Up to 25 custom rules per project
+ Path and header values use substring matching, not wildcard patterns
+ An allow rule can skip later custom rules and the rate limit

// 02 — waf

Set a project-wide rate limit.

The rate limit is separate from custom rule actions. It blocks requests over a per-IP threshold within a five-minute window; set a value from 100 to 2,000,000, or clear the field to turn it off.

+ Applies to project traffic that reaches the rate-limit rule
+ Changes do not require an app build
+ Allow time for rule changes to propagate

// 03 — waf

See the counts behind each rule.

Matched requests shows aggregated blocked, allowed, and counted totals by rule. It is a metrics view, not a log of individual requests. Review the live security rates before enabling protection. Access, product and custom-rule fees are prorated, with request usage charged separately.

+ Managed baseline is independently configurable
+ Bot Protection has its own toggle and path-prefix settings

Current pricing

USD rates from the current billing catalog. Regional references vary with attributed usage.

Loading current rates…

Explore Web Firewall.

See the guide and current pricing before you start.

Get started Read the guide