π§ Viewing 's dashboard as Super Admin β
Return to Admin
Dashboard
Traffic & pipeline overview across all your domains
Requests (24h)
--
WAF blocks (24h)
--
Domains protected
--
Cert expiry, soonest
--
π‘οΈ Attack Overview -- last 24h, blocked requests only
π Origin Domains
π 1. Public Ingress (Edge)
π‘οΈ 2. Inspection
π― 3. Target Origin (Backend)
Action
Hostname
SSL Mode
Cert Expiration
WAF Rule Engine
Target IP / Hostname
Check Type
Origin Health
Manage
βͺοΈ Redirect-Only Domains
Hostname
Redirects To
Code
Manage
Register Domain
π³ Billing
π‘ Every plan starts with a 7-day free trial -- your card is charged automatically when it ends, unless you cancel first. "Manage Billing" opens Stripe's own secure billing portal in a new tab -- payment details, invoices, and cancellation all happen there, never on this page.
π Real-Time Alerts
Loadingβ¦
π‘ System Status
Loadingβ¦
π Analytics
π‘ Live traffic for this domain, sampled every ~15s.
--current sessions open right now
Requests
Response codes
Bandwidth
Top Client IPs (last 60s)
Client IP
Req/min
Loadingβ¦
Top Pages (1h)
Path
Requests
Loadingβ¦
π‘ Requests flagged or blocked by the WAF, most recent first. Kept for 14 days.
Time
Client IP
URI
Rule
Action
Loadingβ¦
π‘ Requests to this domain, most recent first. Kept for 14 days -- for the bigger picture over time, see the Overview charts.
Time
Client IP
Country
Method
Path
Status
Time (ms)
Bytes
Backend Server
User Agent
Loadingβ¦
π Change Log
π‘ Every edit within the domain's currently open draft is snapshotted automatically. Revert restores IP/redirect/rate-limit/bot-challenge rules and load-balancing settings within that draft to an earlier point -- it never affects other domains, and never deploys anywhere on its own. To deploy a finished draft to staging or production, use π Revisions & Deploy instead.
π Revisions & Deploy
π‘
π§ Maintenance Mode
π‘ One maintenance config per domain. Turn it on instantly, or set a schedule window and it'll activate/deactivate itself automatically (checked every minute).
π‘ Shown on a simple maintenance page (500 characters max).
π Schedule a window (optional)
π‘ Activates/deactivates automatically at these times, independent of the on-demand switch above.
π₯ Team
π‘ owner: full access + manage team. admin: full domain/config access. viewer: read-only everywhere.
π Audit Log
π‘ Every config-changing action taken by anyone on your team, most recent first.
Edit Configuration for
Redirect Settings
π Current Edge Nodes
Allowing traffic only from these IPs on your origin's firewall improves security -- it stops anyone from bypassing ShieldIngress (and its WAF/rules) by connecting to your origin directly.
Connection Settings
Origin Servers
Primary Server
π Path-Based Routing
π‘Paths that don't match any group below still load-balance across every server as usual. Pick more than one server for a group to load-balance between just those.
β οΈ Has no effect until at least one path route exists below -- with zero groups, this is automatically ignored so the domain never goes fully dark from this toggle alone.
1. Path(s) for this group
2. Server(s) to route these path(s) to
+ define a brand-new server instead
3. Load balancing for this group (optional)
π‘Retries and timeouts apply even to a single server. Algorithm and persistence only matter once this group has 2+ servers.
βοΈ Load Balancing
π‘Applies across all origin servers for this domain. Off by default -- turn on to customize.
π« IP Access Rules
π‘Block, or allow only, a specific IP or CIDR block from a path on this domain. Use * as a wildcard, e.g. /*.json or /files/secret_*/ -- a path with no * matches it and everything under it, like a prefix. Rules take effect within a few seconds. The β/β order doesn't affect enforcement -- each rule is self-contained -- it's just for organizing your own list.
βοΈ Editing an existing rule -- saving will replace it.
π Geo Blocking
π‘Block, or allow only, specific countries from a path on this domain. Use * as a wildcard, same as IP Access Rules. Country data refreshes weekly.
βοΈ Editing an existing rule -- saving will replace it.
βͺοΈ Redirects & Rewrites
π‘Redirect sends the browser a 3xx to a new URL. Rewrite silently changes the path sent to your backend -- the visitor's URL never changes. If a path also has an IP block rule, the block always takes priority.
βοΈ Editing an existing rule -- saving will replace it.
β±οΈ Rate Limiting
π‘Limit how many requests a single client IP can make to a path within a time window. Use * as a wildcard, same as IP Access Rules. Clients over the limit get an HTTP 429 until the window resets.
βοΈ Editing an existing rule -- saving will replace it.
π€ Bot Challenge
π‘Serve suspicious visitors a short JavaScript challenge before letting them through. "Heuristic" only challenges requests missing basic browser signals (no User-Agent or Accept-Language) -- real browsers pass unnoticed. "Always Challenge" locks a path down for every visitor, e.g. a login page. Use * as a wildcard, same as IP Access Rules.
βοΈ Editing an existing rule -- saving will replace it.
π Allowed Methods
π‘Restrict which HTTP methods are allowed on specific paths -- e.g. only POST/PUT/DELETE on /api/upload. Each rule is self-contained: it only affects the path(s) you list here, every other path keeps accepting every method exactly as before. Note: your WAF's own default policy separately restricts non-standard methods (PUT/DELETE/PATCH) regardless of this setting -- if a method you allow here still gets blocked, check the WAF & Security tab or exempt it via the WAF Rule Builder.
β οΈ Off by default, and your rules stay saved either way -- toggle to pause enforcement without deleting them.
Domain Ownership Verification
π‘This domain won't be routed on the edge or issued an SSL certificate until you prove you control it. Add either one of these -- you only need one.
Name:
Value:
Serve this exact text (no extra whitespace) at:
π‘οΈ WAF Rule Builder
π‘ The specific rule that fired -- matching requests will skip only this rule, not WAF inspection entirely.
π‘ The rule keeps checking everything else it normally would -- only this one field is excluded from it (e.g. ARGS:content on a post editor's save endpoint, so 941320/942100-style rules stop false-positiving on legitimate rich-text HTML).