Security that ships with every deploy.

DDoS mitigation, managed rulesets, custom WAF rules, attack challenge, BotID, and deployment protection run on the same edge path as your CDN. Decide what reaches your application before cache or compute.

Start deploying Read the docs

Easel Firewall. On by default.

Every deployment is protected at the edge before traffic reaches your application: DDoS mitigation and blocking of known malicious IPs at every edge location.

Platform protections

Invisible bot detection with BotID

Use the stock botid package and checkBotId in route handlers. Visitors never see a challenge page.

Read the BotID announcement

app/api/signup/route.ts

import { checkBotId } from "botid/server";

export async function POST(req: Request) {
  const verification = await checkBotId();
  if (verification.isBot) {
    return Response.json(
      { error: "Access denied" },
      { status: 403 },
    );
  }
  // create account…
}

Web Application Firewall

Build custom rules on top of managed protection. Matching happens before cache or compute, and rule changes apply without a redeploy.

Custom firewall rules reference Firewall events in Observability

Attack mode when you need it

Enable project-wide or targeted proof-of-work when under attack. Legitimate visitors pass; automated clients stall at the edge.

Attack Mode docs

lumen-chat.easel.sh

Right access for previews and teams

Protect unfinished deployments and keep security configuration behind workspace roles.

Deployment protection
Gate default preview and project hostnames behind SSO-style authentication.
Learn more
Verified bots
Major search crawlers can pass Attack Mode when you allow verified bots.
Learn more
Workspace roles
Owner, Admin, and Member roles control who can change security settings.
Learn more

Protect the next deployment

Deploy a project, open Security settings, and add a log-only rule first. Read WAF and attack challenge docs before enabling site-wide challenge.