Security
You glance at your traffic chart and something looks off. There's a spike, and most of it is one IP hammering a single endpoint. The work of security on Edgenivo is mostly that loop: notice something off, then do something about it.
Firewall observability
The Firewall dashboard is where you spot trouble. From your project, open the Firewall tab. You'll see a live breakdown of every request: allowed, blocked, challenged. Zoom in on a time range. Click into any category to see IP, user agent, request path, and the rest of the request signature.
This is where you confirm a hunch. A traffic spike, expand it. A jump in challenged requests, click in. The dashboard is the single pane of glass for everything that follows.
DDoS protection (already on)
Before you write a single rule, know what's already protecting you. Edgenivo's global DDoS protection is always on. It's a network-layer feature that absorbs large attacks before they ever reach your project. You don't configure it, you don't pay extra for it, it's there.
Custom rules
To block a specific IP, select ⋯ > Configure, then Add New... > Rule. Give it a name (Block malicious IP), set IP address equals, and paste the address. You can chain conditions for more nuanced rules. Block requests to /admin from outside the US, throttle a route by request rate, deny based on header values.
Save the rule, click Publish, and it's live across the edge in seconds.
Managed rule sets
You don't have to build every defense yourself. Under managed rules:
- OWASP Core Rule Set — defends against common web attacks like SQL injection and cross-site scripting. Browse the individual rules and tune them for your app. It isn't on every plan, so check WAF Managed Rulesets for availability.
- Bot Protection — free, analyzes incoming traffic for unwanted bot activity
- AI Bot Protection — free, blocks known AI scrapers
For Bot Protection and AI Bot Protection, start in Log mode. Watch what hits your site for a day or two, then switch Bot Protection to Challenge and the AI bots rule to Deny once you're comfortable acting on that traffic. Logging first sounds slow, but it prevents a lot of "wait, why is real traffic blocked" pages.
Bot ID
The standard bot rules catch the obvious stuff. Sophisticated actors use real browsers driven by Playwright or similar tools, and that traffic looks human enough to slip through. Bot ID uses fingerprinting and behavioral analysis to catch them.
Bot ID is built on a partnership with Kasada and isn't just a toggle. It requires a small code change to wire up. Apply it strategically on your highest-value routes: login endpoints, checkout flows, APIs that touch valuable data or business logic. Site-wide isn't the right shape for it. Specific, sensitive routes are.
Attack Challenge Mode
If you're under a sustained attack, the regular tools may not be enough. From the Firewall page, click Bot Management, and under Attack Mode (the dashboard's current name for Attack Challenge Mode), select Enable. Visitors get challenged before they touch your app. Known bots like search engines and webhook providers get through automatically, and so do requests from your own Functions and Cron Jobs. This is an emergency tool, not a default setting.
System bypass
The opposite problem: a trusted cron job or internal service keeps getting blocked. Click Add New > System Bypass to add IPs or CIDR ranges that Edgenivo's system mitigations, like DDoS protection, should never block. If your own custom rules are the ones catching it, add a custom rule with a bypass action instead. System Bypass isn't on every plan (limits). Monitoring services, your own backend jobs, and partner integrations are what this is for.
Watching the rules work
After publishing a rule, head back to the Firewall observability view. Traffic from that IP shifts from Allowed or Challenged into Denied. That's how you confirm a rule is doing what you wanted, and how you spot one that's overshooting.
Recap
- The Firewall dashboard is your single pane of glass for traffic and rule effectiveness
- DDoS protection is always on, no setup required
- Custom rules handle surgical strikes against specific IPs, paths, or patterns
- Managed rule sets (OWASP, Bot Protection, AI Bot Protection) handle broad classes of attack; start in log mode before enabling
- Bot ID catches sophisticated browser-driven bots on the routes that matter most
- Attack Challenge Mode is for active emergencies; System Bypass is for trusted systems that need to skip system mitigations
Follow up docs
Was this helpful?