Rules Overview

Rules tell nsin how to handle requests to your site. With a rule you can send people to a new page, change how caching works, slow down attackers, block bad traffic or pick a different server — all at the edge, without touching your own server.

You create rules in the Rules section of your domain.

How a rule works

Every rule has two parts:

1. When — which requests it applies to.
2. Then — what nsin does with them.

If a request matches the When, nsin does the Then.

The kinds of rules

Rule	What it does	Guide
Redirect	Send visitors from one address to another.	Redirects
URL Rewrite	Change the address sent to your server, invisibly.	URL Rewrites
Cache	Decide what is cached, for how long, and what bypasses the cache.	Cache Rules
Block	Refuse requests by path, hostname or country.	Blocking Traffic
Rate Limit	Cap how many requests one visitor may make.	Rate Limiting
WAF	Managed protection against web attacks.	WAF
Challenge	Make a visitor prove they’re human.	Bots & Challenges
Bots	Allow, block or reroute named crawlers and AI bots.	Bots & Challenges
Fingerprint	Match automated traffic that disguises itself.	Bots & Challenges
Origin Pool	Several servers with health checks and failover.	Origins & Failover
Origin Route	Send specific paths to a specific server.	Origins & Failover
Error Page	Choose what visitors see when something goes wrong.	Custom Error Pages

Create a rule

1. Open the Rules section.
2. Click Add Rule.
3. Pick the rule type.
4. Set the When condition and the Then action.
5. Save.

Scoping: which requests a rule covers

Every rule can be narrowed three ways, and they combine:

• Records — apply it only to specific proxied DNS records. Leave it empty and the rule covers the whole zone, which is the usual choice.
• Hostname — match one host exactly, a wildcard like *.example.com, or a pattern.
• Path — a list of paths the rule includes (/* by default — everything) and a list it excludes. Paths match as wildcards, or as regular expressions if you need capture groups.

Tip

Excludes are the neat way to say “everywhere except”. Include /*, exclude /health, and you have a rule that covers the site without touching your health check.

The order of rules matters

Rules of the same type run from top to bottom: the one higher up runs first. Drag rules to reorder them.

Put your most specific rules — and any exceptions — at the top, and broad catch-all rules at the bottom.

Dry run: test before you enforce

Most rule types can be saved in dry run. The rule matches, and the match is recorded, but the request continues untouched. You get to see exactly what a rule would have done to real traffic before it does it.

Use it for anything that blocks, challenges or filters. Caching ignores dry run — there’s nothing to preview.

Turning rules on and off

You don’t have to delete a rule to stop it. Each rule has a toggle; switch it off and back on later. When something breaks right after a change, the toggle is the fastest way to confirm which rule caused it.

Rules and proxied records

Rules only run for traffic that actually reaches the nsin edge. A hostname whose DNS record is not proxied resolves straight to your server, and no rule will ever see it. If a rule seems to do nothing, check this first — see Managing DNS Records.

Ready to make your first one? Start with Redirects — they’re the easiest.