Security events

Every app and website behind the edge is protected without setup. Security events lists what was blocked or challenged and why, so you can tell an attack from a false alarm.

What is on by default

• Rate limits per client and per path. Responses include ratelimit and ratelimit-policy headers; a client over the limit gets 429 with Retry-After.
• Bot scoring of every request. Known good crawlers are recognised; by default other bots are only monitored.
• Browser challenge when a site is flooded: visitors see a short "one moment" page while their browser proves it is real, then continue with a clearance cookie. Your code is not run for challenged requests.
• Lockdown under extreme load, a stricter version of the challenge that protects your origin and code.

The x-rf-security-state header shows the current state (normal, challenge, ), and what was done with a request.