Web protection (L7 & WAF)

Enable web protection#

avenlith shield web create --domain shop.example.com --origin 203.0.113.24
avenlith shield web rule add shop.example.com --path "/login" --rate 20/min --action challenge
avenlith shield web rule add shop.example.com --country RU,TR,DE --action allow
avenlith shield web mode shop.example.com --under-attack on

Point your domain's DNS to the address shown in the console. Avenlith terminates TLS, inspects each request and forwards clean traffic to your origin.

Rules#

• Rate limits per path, IP, country or header
• Challenges — invisible JavaScript proof-of-work instead of CAPTCHAs
• Managed WAF rules for SQL injection, XSS, path traversal and known CVEs
• Bot scores from 1 to 99 to separate humans, good bots and scrapers

Under-attack mode#

During a large HTTP flood, under-attack mode challenges every new visitor for 5 seconds. Returning visitors with a valid cookie are not affected.