Managing your site

Security & threats

The Security tab shows what's being kept away from your site. It's honest about what each layer actually does — which requests are refused outright, and which numbers are estimates — so you always know exactly what protection you have.

Security tab showing threats blocked, a bots-vs-humans split, the firewall status, and recently blocked IPs — The Security tab — IPs banned at the edge, your bot-vs-human split, and the firewall inspecting every request.

The strongest layer is a real block. CrowdSec bans abusive IP addresses at the network layer — an address caught behaving badly (credential-stuffing, hammering login, scanning for exploits) is dropped before its requests reach your site at all. The tab shows the active-ban count, labelled platform-wide because the protection is shared across everyone on Belov Cloud, alongside a list of recently-blocked IPs with the country each came from.

The web-application firewall blocks — a matching request never reaches your site

The OWASP Core Rule Set runs in blocking mode. It inspects every request for web-application attack patterns — SQL injection, cross-site scripting, path traversal — before the cache and before your site, and refuses a match with a 403. WordPress-specific exclusions keep wp-admin, login and the REST API from tripping it. If a legitimate request on a Node or Next.js app ever does trip a rule (a file upload or an unusual JSON body are the usual suspects), an owner or admin can set up to five path prefixes to monitor-only from that app's Security tab: those paths stay inspected and logged, every other path keeps blocking.

Open the Security tab
On the site, click Security. The active-ban count and recently-blocked IPs are the first thing you see.
Read the CrowdSec bans
These are real network-layer blocks. The count is platform-wide; the recent list shows individual IPs with their country, so you can see who's being turned away right now.
Review what the firewall flagged
The OWASP rule set lists requests that matched an attack pattern. These were refused with a 403 before reaching your site — the list is a record of what was stopped, and a useful read on what is currently probing you.
Check the bot-vs-human split
An estimate of how much of your traffic looks automated versus human. It's a heuristic read of the User-Agent each request sent — a useful signal for spotting a bot wave, not a definitive identity check.

Attack traffic is shed before it's billed

DDoS and edge shielding absorb and drop large-scale attack traffic out at the edge, before it reaches your origin — and before it's ever counted toward your bill. A flood that would knock a normal host over is soaked up upstream, so a DDoS attempt costs you nothing and mostly never reaches your site.

Want the full picture of the security stack — WAF, DDoS shielding, container isolation — and what each layer actually does?

How we secure your site →

← All guides