Rule Engine

The rule engine inspects every incoming request against the conditions you define and applies the action you choose to the ones that match: block, challenge, redirect, rate-limit or exempt. You build rules with the visual builder on Console → WAF → [domain] → Rules; no code required, and every change propagates within seconds.

First: your site is already protected

HEIMWALL runs its own managed rules (attack signatures and a threat-intelligence IP list) on every domain by default. You don’t build the baseline protection — the custom rules below are for adding your own fine-tuning on top of it. Details: Managed Rules.

How to build a rule

In the visual builder you create a rule in four steps:

1. Pick a field — which property of the request to look at: IP address, country, path, HTTP header, bot score and many more. Full list: Fields.
2. Pick an operator — how to compare the field: equals, contains, greater than, is in a list, and so on. Full list: Operators.
3. Enter a value — what to compare against (e.g. 203.0.113.42, TR, 80).
4. Pick an action — what happens to a matching request: block, challenge (CAPTCHA/JS), redirect, rate-limit, exempt… Full list: Actions.

Example: Field = IP address, Operator = equals, Value = 203.0.113.42, Action = Block → requests from that IP are blocked.

You can combine several conditions (all of them = AND, any of them = OR). Rules are evaluated top to bottom; exemption (Allow) rules must always sit above blocking rules.

Test with log first

Publish a rule you’re unsure about with the Log (observe only) action first: matches are recorded but nothing is blocked. Once you’ve confirmed the behavior, switch the action to Block.

Where to go next

Create your first ruleWrite a rule step by step with the visual builder.

Ready-made rule examplesScenarios like bot blocking, geo restriction and API protection.

Managed RulesHEIMWALL's protection layers enabled by default.