The zone page has three ways to control who reaches a proxied site. They act at the edge, before a request touches your server.
I'm under attack
For when a site is being hammered. Every visitor is shown a brief interstitial check before the page loads. Legitimate browsers pass through automatically in a few seconds; floods of automated requests do not. It is heavy-handed by design, so turn it off once the storm passes.
Block & challenge visitors
Rules that match a source and apply an action:
| Match | Example |
|---|---|
| IP address or range | One abusive address, or an office range to allow through |
| Country | Block traffic from countries you never trade with |
| Action | Effect |
|---|---|
| Block | The request is refused with an error page |
| Challenge | The visitor must pass a check before continuing |
Challenge is the safer default for a whole country; block is for addresses you are certain about.
Bot Fight Mode
Switch it on to challenge known bad bots around the clock without writing rules. Search engine crawlers and other verified good bots are not affected.
Rules only apply to proxied names
All three work on traffic that passes through the edge, which means records
with the proxy toggle on. An unproxied A record answers with your server's
address directly, and these rules never see that traffic.