Blocking Traffic
A block rule (drop in the API) refuses matching requests at the edge — your server never sees them.
Use a challenge to test traffic, or rate limiting to cap it.
Create a block rule
Section titled “Create a block rule”- Rules → Add Rule → Block.
- Pick what it applies to.
- Save.
| Applies to | Example |
|---|---|
| Paths | /wp-login.php, /admin/* |
| Hostname | staging.example.com |
| Countries | see below |
Blocking by country
Section titled “Blocking by country”- Block these countries — listed ones refused, rest get through.
- Allow only these countries — listed ones get through, everyone else refused.
Countries come from the visitor’s IP — a good-enough estimate, not identity. VPN/proxy users show up at their exit point.
Test before you enforce
Section titled “Test before you enforce”Dry run matches and logs without touching the request. Watch a day, then enforce.
Examples
Section titled “Examples”- Login scanning — Paths
/wp-login.php,/xmlrpc.php→ block. - One region only — allow only
IR→ block the rest. - Close staging — Hostname
staging.example.com→ block.
Common questions
Section titled “Common questions”I blocked myself. Toggle it off, narrow it, re-enable — no need to delete.
Can I block a single IP? Block rules match country, hostname and path only. Use rate limiting for one address, or the WAF for attacks regardless of source.
Blocked visitors see nsin’s page.
nsin’s own 403 page, not replaceable. Error page rules cover only 5xx — see Custom Error Pages.