Unwanted traffic never reaches your code.
Write rules that deny, allow, log or rate-limit requests by address, country, path, header or browser. A change applies on every server at once, and nothing restarts.
What you get
Always-on protection
For every project with no setup: a cap on floods from one address, and malformed requests refused.
Addresses and countries
Deny or allow addresses and ranges (IPv4 and IPv6), or whole countries. IP geolocation by DB-IP (db-ip.com, CC BY 4.0).
Conditions on any part
Method, path, host, browser and any header; equals, starts, ends, contains, in a list or a regular expression. Combine conditions with and and or.
Rate limits
Requests per time window, per address or per header value, shared by every server; then deny or just log.
Order and log mode
Rules run in order. Try a new rule in log-only mode first.
Test before it applies
Ask what the rules would do with a made-up request from a given address and country.
What was stopped
Allowed, denied, logged and rate-limited over time, hits per rule, and the addresses and countries stopped.
Change history
Every rule change is recorded in the activity log with who made it.
One rule for the login page
Ten requests a minute from each address; above that, denied.
curl -X POST https://api.ibel.ai/v1/apps/shop/firewall/rules \
-H "Authorization: Bearer $KEY" \
-d '{"name": "Login limit",
"if": [[{"field": "path", "op": "starts", "values": ["/login"]}]],
"action": "rate_limit",
"rate": {"limit": 10, "window": 60, "key": "ip", "then": "deny"}}'Blocking for everyone
Always-on protection and custom rules are on every plan at no extra charge, and a stopped request is not billed as a function request. Pro has more rules and more rate limits.
Questions
A request the firewall denies never reaches your code, so it uses no invocation or CPU time.
From the DB-IP geolocation database (IP geolocation by DB-IP, db-ip.com, CC BY 4.0), kept on the servers themselves; no lookup leaves them.
Start a new rule as log-only, try it with the test tool, and switch any rule off with one toggle.
Protect your site
The basic protection is on from day one.
Sign-up is by invite for now. If you have a code, create your account.
Sign up withEmail codeSMS code