Skip to main content
Talk to us

Security that ships with every deploy.

DDoS mitigation, managed rulesets, custom WAF rules, attack challenge, BotID, and deployment protection run on the same edge path as your CDN. Decide what reaches your application before cache or compute.

Talk to usRead the docs

Easel Firewall. On by default.

Every deployment is protected at the edge before traffic reaches your application.

Features

Invisible bot detection with BotID

app/api/signup/route.ts
import { checkBotId } from "botid/server";

export async function POST(req: Request) {
  const verification = await checkBotId();
  if (verification.isBot) {
    return Response.json(
      { error: "Access denied" },
      { status: 403 },
    );
  }
  // create account…
}

Use the stock botid package and checkBotId in route handlers. Visitors never see a challenge page.

APIs

  • withBotId
  • initBotId
  • checkBotId
Read the BotID announcement

Web Application Firewall

Build custom rules on top of managed protection. Matching happens before cache or compute, and rule changes apply without a redeploy.

Features

  • Managed rulesets
  • Custom WAF rules
  • Log, deny, redirect, challenge
  • Firewall observability
Custom firewall rules referenceFirewall events in Observability

Attack mode when you need it

lumen-chat.easel.sh

Enable project-wide or targeted proof-of-work when under attack. Legitimate visitors pass; automated clients stall at the edge.

Features

  • Site-wide challenge
  • Bypass for webhooks
  • Allow verified bots
Attack Mode docs

Right access for previews and teams

Protect unfinished deployments and keep security configuration behind workspace roles.

  • Deployment protection

    Gate default preview and project hostnames behind SSO-style authentication.

    Learn more

  • Verified bots

    Major search crawlers can pass Attack Mode when you allow verified bots.

    Learn more

  • Workspace roles

    Owner, Admin, and Member roles control who can change security settings.

    Learn more

Protect the next deployment

Deploy a project, open Security settings, and add a log-only rule first. Read WAF and attack challenge docs before enabling site-wide challenge.

Talk to usRead the docs