Skip to main content

Can I block or allow specific IP addresses, or restrict a page?

Yes, per site, from the Protection tab of the domain’s status page. An Owner or Security Officer makes the changes; the other roles see them.
  • Banned IP addresses: refuse an address or a network, for a day, a week, a month or until you remove it. A Ban button also sits in the Attackers, Blocked requests and Detections tables, and Unban lifts a ban.
  • Whitelist: addresses that always pass, such as your office, so Cloud Defender never refuses them by mistake.
  • Restricted pages: open a login or admin page (for example /wp-admin/ and /wp-login.php on WordPress) only to the addresses and countries you list.
  • Country rule: refuse the countries your site does not serve, or accept only the ones it does.
Cloud Defender applies a change within about two minutes. A new restricted page and a country rule start in test, refusing nobody, until you enforce them.

Why is there an address in my banned list that nobody banned?

It is an automatic ban, marked Auto-ban. A source that keeps sending known attacks to your site is banned from it for 24 hours, and the ban lifts by itself. Google’s own service addresses are never banned this way.

Which addresses should my origin accept traffic from?

To prevent WAF bypass, configure your origin to accept web traffic only from Cloud Defender. Aegister gives you the addresses to allow when your domain is activated: see step 4 of the activation guide.

Can I downgrade from HTTPS to HTTP between the WAF and the protected site?

Yes, you can downgrade from HTTPS to HTTP between the WAF and the protected site, though this weakens security and we do not recommend it.

What advantages does Cloud Defender offer over solutions like AWS Cloudfront + WAF?

Cloud Defender provides IP masking, DDoS protection, caching, origin lockdown, blocking of attack URLs and checks against the OWASP Core Rule Set. What sets it apart is that it blocks traffic from malicious sources automatically, using Aegister’s Threat Intelligence, fed by OneFirewall. If an attacker is identified during an attack on another target, Cloud Defender blocks that source from reaching your site. It is also a managed service: Aegister runs and maintains the rules for you.

Why does the blocked total not add up against the list of attacking sources?

Requests blocked before Cloud Defender began capturing the client’s address carry our CDN’s address rather than the sender’s. They are counted in the total, because they really were blocked, but they cannot be attributed to a source, so they are absent from the attacker table and reported separately in the sentence beneath the total.

My domain says “Not active” but the site is up. Why?

A domain reads Not active if the licence is not live or the health checks do not pass. The licence decides first: if it has expired, the domain is Not active even though its proxy still answers, because we are no longer contracted to protect it.

Who receives the weekly report and the alerts?

The in-app notifications, the weekly report and the email alerts are not available to customers yet. Once they start, both are opt-in: the bell notifications show only to the people who switched on Cloud Defender’s bell, and the emails go only to those who switched on its email. Each person sets their own in Profile → Notifications, and an Owner sets them for every member on Organizations → your organization → Members. Nothing is sent on the basis of somebody’s role, and an organization where nobody switched anything on receives nothing. Licence and renewal notices are separate: those go to Owners and to the administrative point of contact.

Does Cloud Defender block SQL injection and cross-site scripting?

Yes, once you switch it on for the site. Every request is checked against the OWASP Core Rule Set, which covers SQL injection, cross-site scripting and other attack patterns. By default these checks detect and do not block: the matching requests are flagged, not blocked, and listed in the Detections tab of the status page, where you mark a source Legit when its requests are expected, or Ban it. To block them, an Owner or Security Officer opens the Protection tab and switches SQL injection and XSS from Detecting to Blocking. The confirmation shows how many requests in the selected period matched and would have been refused. Within about five minutes matching requests are refused, and they appear in Blocked requests as Signature rule. Switching back to Detecting undoes it in the same time. The switch needs a live licence.
A signature can also match a request your own site needs, and blocking it can interrupt part of your service. Before you switch it on, look at Detections: what it lists as not blocked is what blocking would refuse. After you switch it on, test your site’s main features (sign-in, forms, uploads, any API) and watch Blocked requests over the next days. If a legitimate request is refused, switch back to Detecting.
The other layers block on every site: the origin lockdown, Threat Intelligence, the attack URL rule, which judges only the address and headers of a request, and your own lists.