Request shield: start here
The request shield (the extension exp_request_shield) is a filter in front of the site. It looks at every
request before Exponential starts and decides: let it through, refuse it, or ask the browser to prove it is one
(the browser check). It turns away scanners that look for weak spots, floods from one network, form posts that
did not come from the site's pages and requests for internal files, for a few microseconds each.
You look after it in Setup > Request shield, right after Log files in the Setup menu.
Contents
- Who it is for
- What you see in the administration
- What visitors and editors notice
- The pages of this section
- Related pages
Who it is for
- Administrators read the dashboard and the log, pause the shield or switch between monitor and enforce, and answer when someone says the site refused them.
- Hosting staff and developers install it, give the site its own rule file and add exceptions on the server. Their guide is Setting up the request shield.
You do not need to edit anything to use the administration pages: they show what the shield does, and the switches change exactly the files described in these pages.
What you see in the administration
| Page | What it is for |
|---|---|
| Dashboard | Is the shield running, in which mode, what did it decide in the last 24 hours, which rules decided most. The switches are at the top. The dashboard and its chart |
| Log | Every line the shield wrote, by period and decision. The log |
| Rules | Whether the rule files are in order, and their text. The rules |
Two policies decide who sees what: requestshield/read for the pages, requestshield/manage for the switches.
In a new installation only the Administrator role holds them.
What visitors and editors notice
Usually nothing. A real visitor's requests go through. At the login, and in the administration once per pass, the browser solves the browser check by itself in a fraction of a second; there is no puzzle to solve. A browser without JavaScript or cookies is told what is missing.
A scanner, a flood or a request for an internal file gets a short refusal (mostly 404 or 403, 429 for too many requests) and never reaches the site.
The pages of this section
| Page | What it answers |
|---|---|
| The dashboard and its chart | The notices, the figures, the chart of decisions per hour, the setup box, the rules that decided most |
| The switches | Pause and Switch on, Enforce, Monitor, Off: what each changes, when it takes effect, who may use them |
| The log | Reading the log by period and decision, the columns, the client's network, a link to a view |
| The rules | Which rule file is used, its includes, whether it compiles, the commands that check it |
| Monitor and enforce | The modes, when to watch first, going back to enforce |
| Under Velocity | What differs when Exponential Velocity serves the site |
| Troubleshooting | Symptoms, causes and fixes |
| FAQ | Short answers to the usual questions |
Related pages
- The request shield (feature reference: how it works, files, licensing, who gets it when)
- Setting up the request shield (install, own rules, check and test, update, uninstall)
- Upgrading to 6.0.15: the request shield
- Security hardening
- The library's documentation: request-shield