Attack mode and custom WAF rules

You can turn on site-wide Attack Mode from the dashboard and write custom WAF rules that match path, header, country, and IP at the edge.

Attack Mode

Attack Mode challenges suspicious clients with a proof-of-work step before they reach your origin or functions. Enable it per project when you see abuse, scrapers, or sudden traffic spikes.

Legitimate users complete the challenge and continue. Automated abuse pays a compute cost that slows high-volume attacks. You can leave it off for normal traffic and enable it during an incident.

Custom WAF rules

Create rules that allow, deny, or challenge based on request attributes. Match on path prefixes, headers, source country, and IP ranges so sensitive routes get tighter policy than public pages.

Configure protection

1. Open your project’s Security settings.
2. Toggle Attack Mode when you need site-wide challenge protection.
3. Add a custom rule with match conditions and an action.
4. Save and confirm new traffic hits the rule in Observability firewall events.

Docs: Attack Mode and Custom firewall rules.