Response Fields

Caution

These fields are evaluated in the response phase — after the origin server responds. They are only meaningful combined with the failban action.

Field	Key	Type	Example
Origin Response Status	http.response.status	integer	401
Origin Response Header	http.response.header	name=value	X-Error=rate-limited

Example: Detect 401 floods with failban

IF   http.response.status == 401
THEN failban

This rule increments the failban counter for the IP on every request the origin returns 401 for. Once the configured threshold is reached, the IP is automatically banned.