Security rules
Match website requests and choose how Loclix handles them.
Custom rules
- Open Security for your website.
- Select Add rule under custom rules.
- Enter a name and position.
- Define the Request match.
- Choose a Response action.
- Select Save rule.
Rules run in the order you configure. Start with a narrow match and use Log to inspect its results in request events before blocking traffic.
Request match
Each condition has a Field, Operator, and Value. Select Add condition for another comparison. Combine them with All conditions (AND) or Any condition (OR). Use Add group to combine separate sets of conditions.
Condition options lets you negate a condition or convert its field to lowercase. Group options lets you negate a group.
Expression preview shows the generated expression. Validate expression checks syntax without saving. Use Edit expression to enter an expression directly; expressions the visual builder cannot represent stay in text mode. The limit is 4096 bytes.
Response actions
| Action | Result |
|---|---|
| Block | Returns HTTP 403 and stops custom rule evaluation. In Monitor mode, records the match instead. |
| Managed challenge | Requires a configured verification provider. Browser GET requests receive a challenge; API and WebSocket requests receive HTTP 429. |
| Log | Records the match and continues to the next rule. |
| Skip | Bypasses the components you select. At least one component must be selected. |
Passing a managed challenge continues rule evaluation and request limits. A Skip rule does not bypass request validity checks, deny lists, origin capacity limits, or Zero Trust access policies.
Managed attack rules
Managed rules use OWASP Core Rule Set checks. Detection mode records matches; blocking mode can reject them. If a legitimate request matches, add an exclusion scoped to that request rather than disabling the entire rule set.
Request limits
Set request rates, concurrency, body size, and query limits to suit your application. Check request events after changing them to identify legitimate requests that exceed a limit.
Identity access
Use Zero Trust to require sign-in for private applications. Monitor mode, allowlists, and Skip rules do not bypass identity policies. Signed-in visitors still pass through the website's security rules.