Actions

You choose what happens when a rule matches in the console’s Actions section; the headings on this page match the console boxes one-to-one. Several actions can be combined; only one protection action and only one parameterized action per rule. The THEN {key} notation in the examples is a representative summary written with the action’s technical name.

---

Protection

Single select — one protection decision per request; click again to deselect.

In the console	Key	What it does
Block	block	Blocks the request and shows the block page (403)
CAPTCHA	captcha	Requires CAPTCHA verification
JS Challenge	js	Applies a JavaScript challenge — invisible to the user
Allow	allow	Lifts blocks applied by earlier rules and skips the remaining rules
Log (observe only)	log	Only writes to the Access Logs; nothing else happens

IF   ip.country in RU, CN, KP
THEN block

IF   waf.bot_score ge 70
THEN captcha

IF   waf.client.ip_type == hosting
THEN js

IF   ip.list in "office-ips"
THEN allow

IF   http.request.base_uri has_prefix /admin
THEN log

With these selections in the console:

• Country block — Field Country · Operator in list · Value RU, CN, KP → Action Block
• CAPTCHA on bot score — Field Bot Score (0–100) · Operator greater or equal · Value 70 → Action CAPTCHA
• JS for datacenters — Field IP Infrastructure Type · Operator equals · Value hosting → Action JS Challenge
• Allow the office list — Field IP List · Operator in list · Value office-ips → Action Allow
• Observe the admin panel — Field Path (without query) · Operator starts with · Value /admin → Action Log (observe only)

The Auto-Block checkbox

When Auto-Block in the protection box is checked, IPs that repeatedly trigger your selected protection are banned permanently. Banned IPs are managed on the WAF page.

Tip

When writing a new rule, test with Log (observe only) first; switch to Block or CAPTCHA once you have confirmed the behaviour.

---

Bypass

Multi-select — exempts the matching request from active challenge and limit layers. Apply to trusted sources only.

In the console	Key	What it skips
Bypass CAPTCHA	bypasscaptcha	The active CAPTCHA mode
Bypass JS	bypassjs	The active JS challenge
Bypass Rate Limit	bypassratelimit	The domain-wide rate limit

Security Layer Exemption

In the console	Key	What it skips
Bypass Deny List	bypassdenylist	The Threat Intelligence deny list
Bypass Managed Rules	bypassmanagedrule	HEIMWALL Managed Rules
Bypass OWASP	bypassowasp	OWASP signature scanning

# Office IPs exempt from CAPTCHA
IF   ip.list in "office-ips"
THEN bypasscaptcha

# Partner services exempt from rate limits
IF   ip.list in "trusted-partners"
THEN bypassratelimit

# CMS admin panel exempt from managed rules
IF   ip.list in "cms-admins"
AND  http.request.base_uri has_prefix /wp-admin
THEN bypassmanagedrule

With these selections in the console:

• Office IPs exempt from CAPTCHA — Field IP List · Operator in list · Value office-ips → Action Bypass CAPTCHA
• Partners exempt from rate limits — Field IP List · Operator in list · Value trusted-partners → Action Bypass Rate Limit
• CMS admin exempt from managed rules — Field IP List · Operator in list · Value cms-admins AND Field Path (without query) · Operator starts with · Value /wp-admin → Action Bypass Managed Rules

Caution

Use the security layer exemptions (Deny List, Managed Rules, OWASP) only for requests from trusted sources.

---

Cache / Content Transform Bypass

Turns off the related speed optimisation for this request. Does not conflict with protection actions and can be selected alongside them; it only switches things off — if the optimisation is already disabled, it has no effect.

In the console	Key	What it does
Bypass Cache	bypasscache	The response is neither served from nor written to the cache — it comes fresh from the origin
Bypass Minify	bypassminify	Turns off automatic minification (auto-minify) — so fragile JS/CSS doesn’t break
Bypass Image Optimization	bypassimageopt	Turns off image optimisation — the original (lossless) image is served

# Real-time API always from the origin
IF   http.request.base_uri has_prefix /api/live
THEN bypasscache

With these selections in the console: Field Path (without query) · Operator starts with · Value /api/live → Action Bypass Cache

---

Parameterized Actions

Only one can be used per rule; each opens extra fields in the console.

In the console	Key	Parameters
Redirect	redirect	Target URL + status code (301/302/303/307/308); the URL may contain variables like $request_uri
Rate Limit	ratelimit	Request count (1–100000) + window (5–600 s) + IPv6 prefix — token bucket
Change Backend	backend	The name of a backend group defined in the console
Select Upstream	origin	Routes the request to a different upstream (origin) group
Request Header	requestheader	Adds a name=value header to the request sent to the origin (value is written as-is, no templates)
Response Header	responseheader	Adds a name=value header to the response returned to the user
Set Cookie	setcookie	name, value, path, max_age, httponly, secure, samesite
Delete Cookie	deletecookie	The name of the cookie to delete

# Rate limit the login endpoint
IF   http.request.base_uri == /login
THEN ratelimit 10/60s

# Redirect an old URL to the new one
IF   http.request.base_uri has_prefix /old
THEN redirect https://example.com/new

# Add a marker header the origin can recognise
IF   http.request.base_uri has_prefix /api
THEN requestheader X-Edge-Verified=1

# Add a CORS header
IF   http.request.base_uri has_prefix /api
THEN responseheader Access-Control-Allow-Origin=*

With these selections in the console:

• Rate limit the login — Field Path (without query) · Operator equals · Value /login → Action Rate Limit (10 requests / 60 s)
• Redirect the old URL — Field Path (without query) · Operator starts with · Value /old → Action Redirect (target https://example.com/new)
• Add a marker header — Field Path (without query) · Operator starts with · Value /api → Action Request Header (X-Edge-Verified = 1)
• Add a CORS header — Field Path (without query) · Operator starts with · Value /api → Action Response Header (Access-Control-Allow-Origin = *)

---

Resource Budget

Multi-select — protects heavy endpoints from concurrent load and slow-origin pressure.

In the console	Key	Parameter
Concurrent Request Limit	maxconcurrent	0–100000; excess requests get a direct 503 (0 = unlimited)
Origin Response Time (this rule)	origintimeout	Seconds (1–600); shortens the origin timeout for this request — the domain ceiling cannot be exceeded

# Concurrency cap on the report endpoint
IF   http.request.base_uri == /report/generate
THEN maxconcurrent 5

# Cut off a slow origin early on a fast endpoint
IF   http.request.base_uri == /health
THEN origintimeout 2

With these selections in the console:

• Cap the report endpoint — Field Path (without query) · Operator equals · Value /report/generate → Action Concurrent Request Limit (5)
• Cut the origin short on /health — Field Path (without query) · Operator equals · Value /health → Action Origin Response Time (2 s)

---

Other

In the console	Key	Description
Failban (IP ban counter)	failban	Increments the matching IP’s ban counter; the IP is banned once the threshold is exceeded. Runs in the response phase
Trigger Webhook	webhook	Makes a webhook call on a match
Stop processing after this rule	stop	If the rule matches, the remaining rules in the list are not evaluated; used together with another action

# Increment the failban counter when the origin returns 401
IF   http.response.status == 401
THEN failban

# Let a trusted IP through and stop the rule chain
IF   ip.list in "trusted-ips"
THEN allow stop

With these selections in the console:

• Count the 401s — Field Origin Response Status · Operator equals · Value 401 → Action Failban (IP ban counter) (the console locks the action for this field)
• Allow and stop — Field IP List · Operator in list · Value trusted-ips → Action Allow + Stop processing after this rule

Note

Failban is only meaningful with the http.response.status or http.response.header fields — it is evaluated after the origin responds.