Security
/authoring/security
PreviewHosted planhosted
Security — "Managed presets, WAF groups, custom rules, simulation and the audit trail…" — records the edge security posture for the production lane. The page says that no delivery tier is attached: "These rules are recorded policy: nothing inspects requests, nothing is challenged and nothing is blocked…", and that the events it shows are simulations of the policy against sample requests, not observed traffic.
| Tab | What it does |
|---|---|
| Posture | Three cards — Managed WAF ruleset (Off, Core, Strict), Bot handling (off, monitor, balanced, aggressive), Rate limits (off, generous, standard, strict) — with Current and "Not safe with" tags. Turning a protection off requires a stated reason. A DDoS status of Unavailable, Protected or Mitigating |
| WAF groups | Each group's mode: off, log, challenge or block. Weakening a group needs a Reason and an impact sheet; an unchanged group reads "As shipped: no deviation is recorded for this lane." |
| Rules | Custom rules in precedence order ("No custom rules on this lane…"); a Staged rollout per rule — Simulate at N% or Enforce on N% in steps of 0, 1, 10, 50 and 100 — through an impact sheet; Revisions with Preview restore of revision N → Restore revision N |
| Simulate | A Method, Path, Country and Bot class; Run simulation shows what decided, whether a challenge applies, the rate budget, exceptions, and the rules considered |
| Events | Filter events by rule, route, release, region, action or source, with request evidence; small cohorts are withheld ("Too few events matched…") |
| Audit | Approvals, exceptions, the audit trail, and Export the audit trail as CSV |
WAF groups and custom rules are reserved to the Platform operator role; presets, simulation, events and the audit trail remain open.