Automatic defense: how it works
Automatic defense levels, verdict and step-down timing, how automatic rules advance and stand by, what is never mitigated, circuit breaking and federation.
How it works
Nodes learn each site's normal traffic (the baseline), compare every second's request features with it, mitigate in graded steps when they find an attack, and step back once it ends. Learning, verdicts and mitigation all happen on the node; nothing waits for the control plane once an attack starts.
Site modes: off (nothing collected) → learning (baseline only) → observe only (verdicts and shadow rules, no mitigation) → automatic protection (mitigates after a verdict; needs module.autodefense.auto). Learn for at least a day, observe for at least 7 days, and turn on automatic protection once the verdicts look right.
Baseline maturity goes prior, one hour, one day, one week. The global prior protects from the first minute; until the baseline covers a week, there are no temporary bans (L3 and above).
Mitigation levels
| Level | Action |
|---|---|
| L0 | Observe, record only |
| L1 | Challenge (silent JS, 5-second shield, proof of work) |
| L2 | Rate limit |
| L3 | Temporary ban |
| L4 | Kernel ban (nftables) |
| L5 | Drop at the network card (XDP); runs as L4 when the node's XDP filter is not attached |
The highest level is automatic by default. To cap it, set the site's maximum level to a manual value in the site details until you click "Restore automatic".
Verdict and step-down timing
| Stage | Rule | Time |
|---|---|---|
| Under attack → cooling down | Every triggering feature back within its exit threshold, continuously | 3 minutes; 5 minutes for traffic surges and origin protection |
| Cooling down | Mitigation steps down one level at a time | One level every 2 minutes |
| Event over | No recurrence while cooling down | 30 minutes |
| Automatic rule standby | After the attack and a minute without hits a rule stands by; a recurrence restores its stage at once | 15 minutes |
Automatic rules advance shadow → challenge → block: from challenge to block only after 2 minutes with a challenge pass rate of 5% or less; a pass rate of 30% sends a rule one stage back with a 10-minute cooldown.
Never mitigated: verified search engine crawlers, the site allowlist, your own allow rules, platform nodes and probe networks.
Circuit breaking
A node breaks the circuit of a site's automatic mitigation when false positives exceed the limit, nearly every request of the site is mitigated, the baseline fails, rule delivery fails, or the automatic defense component itself misbehaves.
- After a break no new mitigation is added; existing mitigation steps down one level every 24 seconds and is gone within 2 minutes, and the site runs on your own CC, WAF and DDoS settings.
- The circuit closes 30 minutes after its cause clears; a second break within 24 hours needs an administrator to click "Resume automatic protection".
- Exception: when the component itself is slow (node load too high), existing mitigation stays, sites under attack keep being defended, and only sites not under attack stop adding mitigation. Load often rises when a node is attacked, and defense does not stop then.
Federation
| Scope | What | Default |
|---|---|---|
| Same site, other nodes | A rule one node confirmed is evaluated by the control plane and sent at the challenge stage to the site's other nodes | On |
| Same tenant, other sites | An IP or network temporarily banned on at least 2 of your sites is rate limited on your other sites that have federation on | Off; turn it on in the site details |
| Platform intelligence | Across tenants only counts of IPs and networks are recorded; the current version sends nothing back and does not affect your sites | — |
Your paths, domains and other data are never shared across tenants.
Insight and logs
- The site details show the mode, baseline maturity and circuit state; "Recent verdicts" lists the sources nodes judged as attacks.
- The "Automatic" section of each module (CC, Bot, WAF, scanners and credential stuffing, L4 port groups) shows each node's current automatic value and the reason; "Adjustment history" lists every automatic change, switch to manual, restore and change of bounds.
- Automatic bans go into the site's block log, where you can release one and add it to the allowlist.
Common questions
Automatic protection is on, but an attack only gets challenges
There are no temporary bans until the baseline covers a week; or the site's maximum level is set to a manual value.
The attack stopped, so why are challenges still shown
Attack metrics must stay within the exit threshold for 3 minutes (5 for surges) first, then mitigation steps down one level every 2 minutes.
Legitimate users were caught
Click "Release all" in the site details to revoke all automatic mitigation of the site, or release one entry from recent verdicts or the block log and tick "Mark as false positive". The rule is withdrawn at once and counted in the false positive statistics.
Which nodes run automatic defense
Dynamic routing nodes only. The site's node list marks nodes without support; their traffic is neither learned nor mitigated.