Protect a website

A website's Security tab shows what protects one of its hostnames, such as example.com or shop.example.com, on Coritan's network. Three switches apply to every visitor. The web application firewall (WAF) refuses requests that look like attacks, Under attack mode asks each visitor a simple math question, and Hotlink protection stops other sites from showing your pictures. Rules of your own block or challenge the requests you choose, such as the ones from an IP address, or limit how many requests a visitor sends.

The web application firewall explains how the WAF fits into a web proxy.

• The hostname is on Coritan's network: its A or AAAA record on the domain's DNS tab is Proxied, or it has a web proxy on the Origin tab (Web proxies and DNS records).
• Coritan's network protects only the requests that come through it. A visitor who opens your origin's own address skips everything on this page, so keep that address private.
• The three switches come with every plan. Once account plans open on your account, your plan decides how many rules of your own you can switch on. It counts the rules switched on across all your websites and deployments, and a deployment's rule once, however many of its addresses carry it:

1. In the dashboard, go to Domain Management, open the domain and select the Security tab.
2. When the domain has more than one hostname on Coritan's network, choose one in Settings for at the top of the tab. The other tabs keep the hostname you choose.

The sentence under the hostname says what Coritan's network does for it now, such as whether the WAF checks its requests. With more than one hostname, the Every hostname card at the end of the tab shows the WAF, Under attack mode and Hotlink protection state of each one. Select a hostname there to show it on the tab.

On the Protection card, switch Web application firewall on or off. There is nothing else to save.

With the WAF on, Coritan's network checks each request it forwards to your origin against a set of managed rules. They look for SQL injection, cross-site scripting, file inclusion, remote code execution, malformed requests and known vulnerability scanners. Each rule that matches adds to the request's score. When the score reaches the blocking threshold, the visitor gets a 403 page that says The web application firewall blocked your request to protect this website from traffic that looks malicious. A lower score can still ask the visitor the math question of Under attack mode first.

Coritan maintains the managed rules, and they are the same for every hostname. You cannot change them or exempt a path from them. A page that Coritan's cache answers never reaches them. Your own rules apply only while the WAF is on.

Turn on Under attack mode while automated requests flood the hostname. Every page a visitor opens then asks a simple math question first, such as What is 4 + 7?. A visitor who answers is not asked again for 20 minutes in that browser, while their IP address stays the same. The files a page loads, such as pictures, stylesheets, scripts and fonts, always load, and so do the requests a page makes from inside the browser.

1. On the Protection card, switch Under attack mode on.
2. The dialog asks Turn on Under attack mode for www.example.com? and says which programs it refuses. Select Turn on Under attack mode. Cancel, or Esc, leaves it off.

The switch then reads Turn it off once the attack ends. To turn the mode off, switch Under attack mode off. It turns off without asking.

The question page is titled Just a moment and says Answer this question to continue to www.example.com. The visitor types the answer and selects Continue. A wrong answer shows That answer was not right. Try this question instead. with a new question, and each question is good for 10 minutes.

Under attack mode and hotlink protection work whether the WAF is on or off. Coritan checks them before the cache, so a page the cache keeps asks the question too.

Another website hotlinks your pictures when it shows them on its own pages, and your site pays for the bandwidth. With Hotlink protection on, Coritan's network refuses a picture when the request's Referer header names another site. The request gets a 403 with the text This site does not let other sites show its pictures.

• It covers the files that end in .png, .jpg, .jpeg, .gif, .webp, .avif, .svg, .bmp and .ico.
• The site's own pages still show them. When the domain's DNS zone is on Coritan, the domain and every name under it count as the site, so www.example.com can show a picture from cdn.example.com. Without a zone on Coritan, the hostname and the names under it count.
• Your other domains count as other sites.
• A visitor who opens a picture directly, or whose browser sends no Referer header, still gets it.

To turn it on, switch Hotlink protection on, on the Protection card.

The Block an IP address card lists your rules that match the address a request comes from. Use it to stop the requests from one address, such as 203.0.113.7, or from a range, such as 198.51.100.0/24. An address rule is a custom rule, so it also shows on the Custom rules card, counts toward your plan's rules, and applies only while the WAF is on.

1. On the Block an IP address card, select Add address…. The Add address page opens under the Security tab, with IP address as the Part of the request, Is as the Condition, and Block chosen.
2. Optionally, enter a Name, such as Scraper addresses.
3. In Values, enter one address or range per line, IPv4 or IPv6, such as 203.0.113.7, 198.51.100.0/24 or 2001:db8::/32.
4. To block every address except the ones you list, choose Is not as the Condition. The card then marks the rule Every address except these.
5. Under What our network does, keep Block, or choose Challenge to ask the math question instead.
6. Select Add address. To leave without adding it, select Cancel or the Security link above the heading.

Coritan keeps each value in one standard form. A range keeps its first address, so 203.0.113.9/24 becomes 203.0.113.0/24. A single address has no prefix length, and an IPv4 address written as IPv6, such as ::ffff:203.0.113.7, is read as IPv4. A value you enter twice is kept once.

Coritan's network checks your rules first on every request to the hostname, before Under attack mode, hotlink protection, the cache and the managed rules. Rules that block come before rules that challenge, and rate limits come last. Your rules apply only while the hostname's WAF is on.

1. On the Custom rules card, select Add rule…. The Add rule page opens under the Security tab.
2. Under Type, keep Block or challenge selected.
3. Optionally, enter a Name, such as Admin area. Without one, the table names the rule by its condition.
4. Under Condition, choose the Part of the request and the Condition, and enter the Values, one per line (What a rule can match).
5. Under What our network does, choose Block or Challenge.
6. Select Add rule. The page takes you back to the Security tab.

Block refuses the request with the WAF's 403 page. Challenge asks the visitor the math question of Under attack mode before the page opens. One right answer is good for 20 minutes in that browser for every question on the hostname, but it never lets a request through a rule that blocks. Coritan never challenges the files a page loads or the requests a browser makes from inside a page, so a page that opens always loads in full.

A rate limit counts the requests from each visitor's address, or from each /64 block of an IPv6 address. Past the limit, Coritan answers 429 Too Many Requests with a Retry-After header until the visitor's rate falls back under it.

1. On the Custom rules card, select Add rule….
2. Under Type, select Rate limit.
3. Optionally, enter a Name, such as Sign-in attempts.
4. Under Limit, enter the number of Requests, from 1 to 100,000, and choose the Time window: 10 seconds, 1 minute, 10 minutes or 1 hour.
5. Under Requests that count, keep Every request, or choose Only the requests that match a condition and fill in the Part of the request, the Condition and the Values.
6. Select Add rule.

The table shows the limit as Limit to 30 per minute. The count is approximate: a visitor can get somewhat more requests through before Coritan answers 429, so set the limit with some room above what real visitors send.

The Condition is Is, Is not, Contains, Does not contain, Starts with or Ends with. A method, a country or an IP address takes only Is and Is not. A rule matches when the part of the request fits any of its values, or, for Is not and Does not contain, none of them. For an IP address, Is matches an address inside any of the ranges. Letter case does not matter.

A rule takes up to 50 values of up to 200 characters each, as plain text. A rule never matches a request that lacks the part it reads: a request with no Referer header, or one whose country Coritan cannot tell. That holds for Is not and Does not contain too.

• The Enabled switch in the rule's row on the Custom rules card turns it on or off. The rule stays on the card while it is off, and the Block an IP address card marks an address rule that is off This rule is off.
• To change a rule, open its actions menu on either card, select Edit rule…, make the changes on the Edit rule page and select Save rule. A rule's type stays as it is.
• To delete it, open its actions menu, select Delete rule…, then Delete rule to confirm.

A rule that Coritan support changed for you shows Changed by support under its name, or is named Rule changed by support when it has none. You can rename it, switch it off or delete it, but not change its condition.

Each hostname holds up to 200 rules of your own, and up to 50 of them can be rate limits, whatever your plan.

The Recent activity card shows how many requests to the hostname Coritan's network blocked in the last 24 hours, as Blocked by our network, beside all its Requests. The count covers what the WAF, your rules, rate limits and hotlink protection refused. Pages that ask the math question are not counted, and a request shows on the card within about two minutes. When nothing was blocked, the card says so, such as Our network blocked none of the 1,204 requests to www.example.com in the last 24 hours.

Select View traffic to open the domain's Overview tab. Its Traffic section charts the requests each hour and how many of them Coritan's network blocked, and By hostname lists the blocked requests for each hostname (View web proxy traffic).

Each change shows a confirmation, and the switch or the rule's row shows the new state:

• WAF turned off for www.example.com.
• Under attack mode turned on for www.example.com.
• Hotlink protection turned on for www.example.com.
• Rule "Admin area" added., Rule "Admin area" saved., Rule "Admin area" turned off. or Rule "Admin area" deleted.

The sentence at the top of the tab and the Every hostname card show the new state too.

The tab says example.com is not on our network yet

No hostname at the domain or under it is on Coritan's network on your account. Select Proxy a DNS record to turn Proxied on for an A or AAAA record on the DNS tab, or Set up a web proxy to forward a name to any server from the Origin tab.

A hostname is not in Settings for

The list holds your account's web proxies at the domain and under it. A name that reaches your server some other way, such as a DNS record that is not Proxied, is not on Coritan's network.

Visitors see The web application firewall blocked your request to protect this website from traffic that looks malicious.

A rule of yours that blocks matched the request, or enough managed rules matched for the WAF to refuse it. Check your own rules first, the addresses on Block an IP address among them. If the managed rules refuse real visitors, turn the WAF off for that hostname and contact support with the address and the time of a refused request.

Visitors see Answer this question to continue to example.com.

Under attack mode is on, a challenge rule of yours matched, or the WAF found the request suspicious but not bad enough to refuse. The visitor types the answer and selects Continue, and is not asked again on that hostname for 20 minutes while their IP address stays the same.

Your API clients, webhooks or uptime monitor get 403

Under attack mode is on for that hostname, and these programs cannot answer the question. Switch Under attack mode off once the attack ends.

Another site shows your pictures as broken, or as This site does not let other sites show its pictures.

Hotlink protection is on, and the page that shows the picture is on another site. Your other domains count as other sites. Switch Hotlink protection off, or serve the picture from the site whose pages show it.

Enter an IP address or a range, such as 203.0.113.7 or 203.0.113.0/24.

A line in Values is not an address or a range. Write each one on its own line, with no port, such as 203.0.113.7 or 2001:db8::/32.

The card says Our network applies these rules only while the WAF is on for example.com.

The hostname's WAF is off, so none of its rules apply. Select Turn on the WAF.

The card shows Custom rules come with the Pro plan, and Add rule… and Add address… are unavailable

Account plans are open on your account, and the Free plan includes no rules of your own. An address rule is a custom rule, so the Block an IP address card says An address rule is a custom rule, and custom rules come with the Pro plan. A rule of a type your plan leaves out shows its offer above the form, such as Country rules come with the Business plan. The Add rule page opened by its address shows the same offer in place of the form.

A dialog about your plan opens when you add a rule or switch one on, or the API answers 402

The rule would take the account past its plan, and the dialog offers the plan that allows it (When your plan refuses something). Switch off a rule you no longer need, or move to that plan.

A website can hold up to 200 rules of your own. Delete one to add another.

The hostname has 200 rules of yours, which is the most any plan allows. Delete one first. Rate limits stop at 50 with A website can hold up to 50 rate limits. Delete one to add another.

Could not change Under attack mode for www.example.com, with a reason

The change did not save, and the switch shows the state that still applies. The other two switches say Could not change the WAF for www.example.com and Could not change hotlink protection for www.example.com. Fix what the reason names, then switch it again.

• How web proxies work
• View web proxy traffic
• Manage a website's origin
• What each plan includes

The three switches are fields of the web proxy: waf_enabled, under_attack and hotlink_protection. Read them with GET /api/v1/proxy/routes/{route_id}, and change them with PATCH /api/v1/proxy/routes/{route_id}, sending only the fields to change. GET /api/v1/proxy/routes lists your web proxies with the same fields, and a web proxy's id there is its route_id.

curl -X PATCH https://api.coritan.com/api/v1/proxy/routes/31 \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"under_attack": true, "hotlink_protection": true}'

The answer is {"message": "Route updated"}. The API does not ask before it turns Under attack mode on, so send {"under_attack": false} once the attack ends. A body with no fields answers 400 with No fields to update.

The Recent activity card reads GET /api/v1/proxy/traffic?domain=example.com&route_id=31&hours=24, and shows totals.blocked out of totals.requests (View web proxy traffic).

Add a rule to a web proxy. kind is match or rate_limit. field is path, query, method, user_agent, referer, cookie, country or ip, and operator is is, is_not, contains, not_contains, starts_with or ends_with. A method, country or ip rule takes only is and is_not. A match rule takes an action of block or challenge. This rule blocks one address and a range:

curl -X POST https://api.coritan.com/api/v1/proxy/routes/31/waf-rules \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"kind": "match", "description": "Scraper addresses", "field": "ip", "operator": "is", "values": ["203.0.113.7", "198.51.100.9/24"], "action": "block"}'

The answer is 201 with the rule, its values in the form Coritan keeps them:

{
  "id": 512,
  "kind": "match",
  "description": "Scraper addresses",
  "field": "ip",
  "operator": "is",
  "values": ["203.0.113.7", "198.51.100.0/24"],
  "action": "block",
  "requests": null,
  "period": null,
  "enabled": true,
  "editable": true,
  "created_at": "2026-09-25 10:00:00"
}

A rate limit takes requests, from 1 to 100,000, and period in seconds: 10, 60, 600 or 3600. Leave out field to count every request:

curl -X POST https://api.coritan.com/api/v1/proxy/routes/31/waf-rules \
  -H "Authorization: Bearer $CORITAN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"kind": "rate_limit", "description": "Sign-in attempts", "field": "path", "operator": "is", "values": ["/login"], "requests": 10, "period": 60}'

enabled is true unless you send false. A rule added switched off needs room in your plan only when you switch it on.

List a web proxy's rules with GET /api/v1/proxy/routes/31/waf-rules. The answer holds rules, oldest first, and what the account uses against its plan:

{
  "rules": [],
  "managed_rules": 28,
  "account": {"custom_rules": 3, "rate_limit_rules": 1},
  "limits": {"custom_rules": 20, "rate_limit_rules": 0, "country_rules": false},
  "per_website": {"rules": 200, "rate_limits": 50}
}

account counts your rules that are switched on, across every website. limits is null until account plans open on your account, and -1 in it means no limit. managed_rules counts the managed rules switched on for the web proxy.

Change a rule with PATCH /api/v1/proxy/routes/31/waf-rules/512, sending only what changes, such as {"enabled": false}. Send field, operator and values together. A rule with editable set to false is one Coritan support changed: it takes only enabled and description, and anything else answers 422 with Support changed this rule, so it can only be switched on or off, or deleted. Delete a rule with DELETE /api/v1/proxy/routes/31/waf-rules/512, which answers {"message": "Rule deleted"}.

These calls answer 422 with the reason for a rule that does not check out, such as Enter an IP address or a range, such as 203.0.113.7 or 203.0.113.0/24. or An ip rule can only use is or is_not. They answer 402 with entitlement_exceeded when the plan leaves the rule out, and 429 after 60 rule changes in a minute. When Coritan could not finish checking a new or changed condition, they answer 400 with This rule: we could not check whether our network can run it. Try again, or simplify it, and the same request can succeed when you send it again. A web proxy that is not yours answers 404.