Control traffic before it reaches your app_
Define project rules that match the request properties you care about, then deny, bypass, rate limit, redirect, or challenge traffic before it hits your API, Functions, or Sites.
- 1allow-officeBypass
- 2block-scrapersDeny
- 3api-rate-limitRate limit
- 4eu-redirectRedirect
Deny, bypass, rate limit, redirect, or challenge
Every rule applies one action when conditions match. Deny abusive traffic, bypass trusted clients, throttle per IP, redirect to maintenance URLs, or challenge suspicious requests before they continue.
Deny
Reject matching requests before they reach your project.
Bypass
Allow the request and skip later Firewall rules.
Rate limit
Throttle matching requests that exceed a per-IP quota.
Redirect
Send matching clients to another location with a 3xx status.
Challenge
Present a challenge before allowing suspicious clients through.
Match on rich request attributes
Build rules from the request properties that matter to your app. Combine conditions so a rule only fires when every filter matches.
Incoming
POST/v1/account/sessions
- IP address
- 203.0.113.10
- Country
- DE
- User agent
- python-requests/2.31
/v1/accountPOSTpython-requestsDeny
403Every condition on a rule must match before the action runs.
Scope rules to API, Functions, or Sites
Apply policies to the project API, a specific Function, or a specific Site. Keep production APIs locked down while preview sites and health checks stay reachable.
Resource scope
Deny account mutations
POST /v1/account/*
Choose where the rule evaluates matching traffic.
API
SelectedProject REST and GraphQL endpoints.
project
Functions
A specific Function execution endpoint.
fn_checkout
Sites
A specific Site deployment hostname.
site_storefront
Priority decides the first match
Lower priority numbers evaluate first. Place bypass allowlists ahead of broader deny, rate limit, or challenge rules so trusted traffic skips the rest of the chain.
Incoming
GET /v1/databases 10.0.4.21
Office IP allowlist
Bypassip == 10.0.4.21
Deny account mutations
Denypath starts_with /v1/account
Rate limit public API
Rate limitpath starts_with /v1
Preview impact before you enable
Estimate how much recent traffic a draft rule would affect, then refine conditions before you turn it on.
Rate limit public API
Estimated impact
path starts_with /v1method == POSTMatched
Total traffic
Matched by rule
Monitor denied, limited, redirected, and challenged traffic
Track request volume alongside denied, rate-limited, redirected, and challenged outcomes on the Firewall page. Confirm policies after enablement without leaving the Console.
Passed
Denied
Challenged
Rate limited
Redirected
Block rate
FAQ_
Firewall rules run on Appwrite Cloud before traffic reaches your project resources. Scope a rule to the project API, a specific Function, or a specific Site. Console traffic is never blocked, so you can keep managing rules even when deny or rate limit policies are active.
Start protecting with Firewall_
Create your first deny, bypass, rate limit, redirect, or challenge rule from the Console and preview impact before you enable it.
Explore Appwrite_
Modular backend services that share the same project, permissions model, and console.