Blocking Traffic

A block rule (called a drop rule in the API) refuses matching requests at the nsin edge. Your server never sees them, so they cost you nothing.

Use it when you already know the traffic is unwanted. If you want to test whether a request is a real person, use a challenge instead. If you want to allow traffic but limit how much of it, use rate limiting.

Create a block rule

1. Go to Rules → Add Rule → Block.
2. Choose what it applies to:
   • Paths — for example /wp-login.php or /admin/*.
   • Hostname — one subdomain rather than the whole domain.
   • Countries — see below.
3. Save.

Blocking by country

Country matching works two ways, and the difference matters:

• Block these countries — every listed country is refused; everyone else gets through.
• Allow only these countries — the listed countries get through; everyone else is refused.

Caution

“Allow only these countries” is a big hammer. Make sure your own country is on the list before you save, or you’ll lock yourself out of your own site.

Countries are detected from the visitor’s IP address. It’s a good-enough estimate, not an identity check — VPN and proxy users will show up as wherever their exit point is.

Test before you enforce

Every block rule can run in dry run mode. The rule still matches and still gets recorded, but the request goes through untouched. Watch the logs for a day, confirm the rule is catching what you meant, then switch it to enforce.

This is the safest way to introduce a broad rule.

Examples

Stop WordPress login scanning

• Applies to: /wp-login.php, /xmlrpc.php
• Action: block

Serve one region only

• Countries: allow only IR
• Action: block everything else

Close a staging subdomain to the public

• Hostname: staging.example.com
• Action: block

Common questions

I blocked myself. Turn the rule off with its toggle — you don’t have to delete it. Then narrow the rule and switch it back on.

Can I block a single IP address? Block rules match on country, hostname and path. For a single misbehaving address, rate limiting usually solves the real problem (too many requests), and the WAF handles attack traffic regardless of where it comes from.

Blocked visitors see an ugly page. You can replace it with your own — see Custom Error Pages.