Platform protections
Learn about the always-on protections Easel applies to incoming traffic.
Platform protections identify and mitigate malicious or abusive traffic before it can consume application resources.
They are managed by Easel and apply without project-specific configuration.
What platform protections cover
Platform protections are designed to mitigate traffic such as:
- Network floods
- Application-layer request floods
- Known malicious sources
- Automated vulnerability scanning
- Repeated abusive behavior
- Suspicious request patterns
- Attempts to exhaust functions or origin resources
The specific detection systems and data sources used by Easel may change over time. The customer-facing contract is the protection behavior, not a particular internal implementation or third-party provider.
Automatic operation
Platform protections are always active for supported Easel deployments.
They do not require:
- Custom firewall rules
- Attack Mode
- Application middleware
- Framework configuration
- Changes to application code
Project-specific firewall settings provide additional control but do not replace the underlying platform protections.
What happens to blocked traffic
Traffic rejected by a platform protection is stopped before it reaches static output or invokes a function.
Blocked requests do not run your application code. They may still appear in security and request analytics so you can investigate activity. Do not assume blocked traffic is excluded from every usage meter unless a billing document states that explicitly.
Visibility
When a platform protection stops a request, Easel exposes enough information for you to understand the outcome without revealing sensitive detection details.
Useful signals include:
- Action taken (for example block, challenge, or throttle)
- Request ID and timestamp
- Path, method, and hostname
- Whether the decision came from platform protection rather than a custom rule
Easel does not expose internal provider names, private detection signatures, raw reputation scores, or details that make evasion easier.
Customer overrides
Custom firewall rules cannot disable platform protections.
The Bypass attack challenge action skips project-wide Attack Mode only. It does not override platform blocks, deployment protection, or other edge safety controls.
DDoS protection
Platform protections help absorb network and HTTP request floods at the edge. They are not interchangeable with:
- Custom firewall rules
- Attack Mode
- Application authentication
- Application-level rate limiting or quotas
No traffic-protection system can guarantee that every application remains available during every attack. Protect expensive endpoints with authentication, caching, validation, and carefully scoped firewall rules.
Limitations
Application design still matters. Protect expensive endpoints with:
- Authentication
- Authorization
- Caching
- Request validation
- Idempotency
- Application-level quotas
- Efficient database queries
- Carefully scoped firewall rules