The edge

Every request to your site passes through a proxy on the machine before it reaches your application. It terminates HTTPS, routes the hostname to the right environment, and applies the rules below. Some of them are the platform's and apply to everyone; the rest are yours, set per environment on the Routing tab.

#In order

A request meets the checks in this order, and the first one that refuses it answers:

1. HTTPS. Plain HTTP is redirected to HTTPS — see Domains.
2. Probe guard — the platform's, below.
3. Blocked addresses, allowed addresses and blocked user agents.
4. Password protection.
5. Rate limit.
6. Compression and HSTS, on the way back out.
7. The canonical redirect, if the hostname is not the canonical one.

So a scanner is turned away before it is ever asked for a password, and an address you have blocked never gets as far as counting against a rate limit.

#What is refused for everyone

The probe guard turns away requests for files no site should serve, before they reach your application: the ones an automated scanner asks every server on the internet for, hoping one of them answers. Hidden files, paths that try to climb out of the web root, and the well-known names of configuration and credential files — along with backup copies of those.

/.well-known/ is the exception, because certificates and app links live there. Matching ignores case.

A refused request gets a 404, not a 403. A 403 tells a scanner the file exists and is worth coming back for; a 404 says there is nothing here, which is also true of what it can reach.

It is deliberately narrow, and it is not a firewall that understands your application: it will not stop an attack on a URL your application really serves. What it does is take the noise away, so your logs and your PHP workers are spent on visitors.

You cannot turn it off or change what it covers. If a path your application genuinely needs is refused, tell us.

#Your rules

On the environment's Routing tab, under Proxy options. Each environment has its own, so staging can be locked to the office while production is open.

Not on shared infrastructure. An environment on a machine the platform shares between customers has no proxy options: the proxy there is not yours alone, and the tab says so. Your own machines, dedicated or shared between your own environments, have them.

#Allowed and blocked addresses

One address or range per line, IPv4 or IPv6 — 203.0.113.7, 203.0.113.0/24, 2001:db8::/32.

• Allowed addresses: when there are any, only those can reach the environment. Empty means everyone. This is how a staging site is kept to the office.
• Blocked addresses are refused even if the allow list permits them. That is what you want when the address is a scraper rather than a stranger.

A refused visitor gets a 403.

Behind a CDN, the address is the one the CDN reports. Every request arrives from the CDN, so the rules are matched against the visitor address it passes on — the platform CDN's, or the header of the network you named on your domain — and only on requests that came from that CDN's published edge addresses. Anything connecting directly is judged by its own address, so the header cannot be forged past the rules. For a CDN that publishes no edge addresses — Akamai, or one the platform has no entry for — the header is never believed: a block list stops nobody and an allow list stops everybody. Domains has the details.

#Blocked user agents

One per line, matched anywhere in the user agent and ignoring case — GPTBot is enough. A match gets the same 403.

This is for crawlers that name themselves honestly. Scanners send an ordinary browser's user agent, so blocking by name will not stop them — that is what the probe guard and the address lists are for.

#Password protection

One user:hash per line, the format htpasswd writes:

htpasswd -nB reviewer

A plain password is refused. It would be readable by everyone who can open the Routing tab.

It covers every hostname of the environment, the platform hostname included — a password that only guarded your own domain would leave the site open at its vallic.cloud address. The two things that pass without it are the challenge a certificate authority uses to issue your certificate, and the platform's own health check.

Use -B (bcrypt). The form accepts some older hash formats as well, but bcrypt is the one to rely on.

#Rate limit

Requests per second a single client address can average, and a Burst it may go over that by for a moment. Zero means no limit; a burst left at zero is the same as the rate. A client over the limit is answered 429 Too Many Requests until it slows down.

The address counted is the one that connects. Behind a CDN that is the CDN's edge server rather than your visitor, so a limit set for one person is a limit on everyone that edge server carries. Set it behind a CDN only with that in mind, or leave rate limiting to the CDN.

#Compression

Compress responses has the proxy compress what your application sends. Off unless you turn it on, because many applications and most CDNs compress already, and compressing twice costs CPU for nothing.

#HSTS

HSTS max-age, in seconds tells browsers to refuse plain HTTP for your site for that long. Zero, the default, does not send the header.

Browsers remember it, so a value set by mistake outlives the mistake. 604800 (a week) is a sensible first step; raise it once you are sure. The header is sent without includeSubDomains or preload, and there is no setting for either.

#Keeping a visitor on one machine

Only offered where an environment answers from more than one web machine. See the note on the form: it is for an application that keeps sessions on local disk and cannot move them, and it costs you some of what the second machine was for.

#Taking a site offline

Show the offline page instead of the site, on the Routing tab. Visitors get a 503 with a Retry-After, which tells search engines the outage is temporary rather than the page gone. You can add a one-line note for visitors.

The site keeps running behind it. Deploys, the shell and restores all still work, so this is the switch for work you would rather nobody watched — a large migration, a restore, a content freeze.

There is no bypass: no address, cookie or hostname that sees the site while it is offline. Check your work on staging, or turn the page off again to look.

It needs the Admin role. Deploys do not use it: a deploy never takes your site offline on its own.

#When your application is not answering

If your application returns a 502, 503 or 504, or does not answer at all, visitors get the platform's page for it instead of your application's response. That includes a 503 your application sends deliberately — its own maintenance page is replaced by the platform's.

#When a change takes effect

Saving does not restart anything. The proxy's configuration is rebuilt from what is saved and sent to the machine, and the proxy reloads it without dropping connections.

Saving sends it: every machine the environment runs on is asked to rebuild its configuration, and picks that up within about a minute. That applies to the options on this page, the project's edge pages, and taking a site offline.

#Who can do what

	Role needed
Proxy options	Developer — Owner on a protected environment
Taking the site offline	Admin

See Teams.

#Next

• Domains — the hostnames these rules apply to
• CDN — caching and blocking by country, further out