Security

Every app has a Security tab with protections that run at velixir's edge, before a request reaches your app. Changes take effect on the next request, with no redeploy.

Web application firewall

The firewall checks every request against the OWASP Core Rule Set and catches SQL injection, cross-site scripting, path traversal, and automated scanners.

  • Off - no inspection. Requests go straight to your app.
  • Detect only - inspect and record, block nothing. Start here: it shows what blocking would stop before it stops anything.
  • Block - matching requests get a 403.

Strictness is Standard or Strict. Standard suits almost every app. Strict catches more, but flags apps that accept rich input like markdown, HTML, or code.

Recent events lists what the firewall stopped, or would have stopped in Detect only mode, with the rule IDs that matched. If a rule flags something legitimate in your app, add its ID under Rule exclusions with a reason, and it's switched off for your app.

The path we recommend: Detect only for a few days, exclude anything that is your own app's normal traffic, then switch to Block.

Rate limiting

Caps on what a single IP address can do, enforced before requests reach your app:

  • Requests per second per IP - over the limit, the client gets 429 Too Many Requests and is asked to retry a second later. Around 100 suits a typical web app, 500-1000 a busy API or a page that polls, and 10-50 something locked down.
  • Open connections per IP - how many connections one IP can hold open at once, which stops a single client tying up your app with connections it never finishes. 50 leaves plenty of room for real browsers.

Under attack mode

When it's on, every visitor's browser has to pass a check before it reaches your app. A real browser clears it in a second or two; a botnet has to pay that cost on every request from every machine, which makes a flood too expensive to keep up.

Turn it on only while you're being attacked. Anything that can't run JavaScript is blocked while it's on, including API clients, webhooks, uptime monitors, and feed readers, and every first-time visitor waits a moment.