Security Gateway

Protect your domain with Vorynza's WAF-like security gateway. Monitor, challenge, and block malicious traffic.

The security gateway provides WAF-like protection for your proxied domains. It inspects incoming traffic and applies rules based on threat scores, rate limits, and path patterns.

Prerequisites

The security gateway requires a zone in full hosting mode with proxy enabled on the records you want to protect.

Modes

Mode	Description
`off`	Security gateway disabled
`monitor`	Log threats without blocking
`managed`	Automatically challenge suspicious traffic
`strict`	Challenge moderate and high-risk traffic
`under_attack`	Challenge all traffic with a JavaScript challenge

Sensitivity

The sensitivity level (0–100) controls how aggressively traffic is classified as suspicious. Higher values trigger challenges on lower-risk traffic.

0–30 — Only block or challenge clearly malicious traffic
31–60 — Challenge moderately suspicious traffic (default: 50)
61–100 — Challenge even slightly anomalous traffic

Challenge TTL

The challengeTtlSeconds (300–86400) controls how long a passed challenge is valid for a visitor. After the TTL expires, the visitor may be challenged again.

Custom rules

Custom rules allow fine-grained control over specific paths:

Field	Description
`pathPattern`	URL path pattern to match
`action`	Action to take: `allow`, `log`, `rate_limit`, `challenge`, `block`
`sensitivity`	Override sensitivity for this rule
`status`	`active` or `disabled`

Rules are evaluated in order. The first matching rule determines the action.

Rule actions

Action	Description
`allow`	Skip all checks
`log`	Log the request without blocking
`rate_limit`	Apply rate limiting
`challenge`	Present a challenge (e.g. CAPTCHA)
`block`	Block the request

You can configure up to 50 custom rules per zone.

Event logs

The security gateway logs every action taken. Events include:

Hostname and path
Action taken (allowed, logged, rate_limited, challenged, blocked)
HTTP method
Country of origin
Threat score
Reason codes

The event summary endpoint provides aggregated counts and top attacked paths for the last 24 hours (configurable).