Website Protection

The Firewall Panel is available at firewall.hostrox.net. Use it to configure traffic protection and filtering for your protected resources — sensors, lists, geo and header rules, and advanced thresholds.

​

Getting started

Once the product is activated, it appears on your account’s main page and in the My products section. Click the product name to open the settings panel.

1. In the settings, find the object you want to configure and click its row (the one that displays a small graph thumbnail).
2. In the left-hand menu, select Protection.
3. Configure the parameters described below.

​

Protection mode

Choose the active protection method applied to incoming traffic.

​

Proactive protection

Protection based on a positive security model. Users whose behavior does not match the model can be blocked or subjected to additional checks, depending on the configured settings. When proactive protection is enabled in sensor mode, requests are not filtered, but each new visitor is evaluated against multiple parameters:

• Pages visited on the site
• Use of keep-alive connections
• Presence of attacks on other sites
• Whether request limits are exceeded
• User Agents used
• Other indicators

If violations are detected, the user’s behavior continues to be monitored. Selective validation makes it possible to avoid switching the entire configuration into active mode.

​

Cookie

Limit the duration of user sessions to reduce the window of opportunity for unauthorized actions. When the configured time expires, users must re-authenticate. The default value is 30 minutes. Clicking Generate new protection key forces all active users to revalidate their sessions.

​

Whitelist, Blacklist, Greylist

Manage IP, subnet, and ASN-based access lists from the same panel. Switch between tabs to configure each list.

​

Geolocation Filter

Restrict access to your resource based on the visitor’s country of origin.

1. Click Add country and fill out the form. Countries are available from a dropdown list.
2. Assign a specific protection level to each selected country.

The protection level escalates incrementally from the current state: SENSOR → REDIRECT → JS → JSA → CAPTCHA

​

Exceptions by location

Disable interactive checks for specific request paths — useful when only bots or mobile apps access a particular server resource and a check would break the client. A request is sent to the whitelist if its path contains a segment specified in this setting. For example, adding /location to the whitelist will skip checks for:

• site.com/location
• site.com/location/
• site.com/location.php
• site.com/location.php?id=123
• site.com/admin/location

But these requests are still processed by the general rules:

• site.com/some-other-location
• site.com/en_location.php

Click Add location and fill out the form that appears.

​

Header Filter

Create rules to block or allow requests containing a specific header. Especially useful when working with APIs, where requests are made by a separate application. You can specify a single header or a combination of several. Click Add rule and fill out the form:

• Choose Allow or Deny as the action.
• Provide a Header name and Header value.
• Use Add condition to combine multiple headers in a single rule.

​

Location filter

Configure filtering for different locations of your resource. A default rule template is provided — edit it from the row actions, or create a new rule from scratch with Add rule. Key fields:

• URL address — location to match (examples: /foo.bar, /foo/, /bar/).
• Number of requests per specified interval and Request count interval (seconds) — define the rate-limit window.
• Action — what to do when the threshold is exceeded.
• Ban time (minutes) — duration of the block.

​

Additional parameters

• Count subject — specify a unique user identifier (uid) to refine the rule. The uid is calculated from request parameters, IP, and JA3. If not selected, the calculation uses the IP address.
• Additional — create a stop rule by setting stop=1. If a request matches a rule with stop=1, subsequent rules are not evaluated for that request. You can have multiple STOP rules.

​

Advanced settings

Experienced users can configure sensor parameters, application-level (L7) bot detection, and network-level (firewall) thresholds.

​

L7 sensor settings

Parameters that control attack detection.

​

L7 block rules

Values used to detect bot activity at the application level. If more requests arrive from an IP than the RPS Limit, and the percentage of blocked requests exceeds the Block Limit, the system identifies the address as malicious and blocks it at L7. The user from that IP sees an error page instead of the site.

• Blocked part
  • Block Limit (%)
  • RPS Limit
• Location diversity
  • Uniformity Location (%)
  • RPS Limit

​

Firewall block rules

Network-level thresholds that block traffic from nodes, subnets, and networks without activating application-level filtering.

• Ban RPS threshold — if exceeded, the IP is blocked without additional checks.
• Blocked part L3 (%) — if RPS Limit is exceeded and the proportion of blocked requests from that IP surpasses Block Limit, the address is blocked.
  • Block Limit (%)
  • RPS Limit

Click Apply to save your advanced settings.