Manage access rules

Overview

Access rules help you block requests before they reach your website. In Sitefinity Cloud Management Portal, you can create block rules for all environments or only for selected environments. Each rule evaluates one or more request conditions, and the rule is applied only when all configured conditions match.

You can use access rules to protect non-Production environments, restrict traffic from specific networks or regions, or block requests for specific hosts, paths, or query patterns.

Open the Access rules page

To open access rules, perform the following:

1. Log in to Sitefinity Cloud Management Portal.
2. In the left pane, click Access rules.

The Access rules page displays the configured rules for the project and provides filters by rule, name, and environment.

Create an access rule

To create an access rule, perform the following:

1. On the Access rules page, click Create a rule.

2. In Rule name, enter a descriptive name for the rule.

3. Under Apply this rule to..., select one of the following options:

   • All environments
   • Selected environments...

4. If you want to apply the rule to Selected environments..., specify one or more environments.

5. Under Block requests matching all of the conditions..., add the first condition.

6. In Field, select the request attribute that you want to evaluate.

   Available fields include the following:

   • URI query string
   • URI path
   • Hostname
   • IP address
   • Country
   • AS number (Autonomous System (AS) Number)

7. Select the operator for the condition and enter the required value.

8. If you need additional conditions, click Add condition.

9. Click Next.

10. Review the rule summary and click Create.

IMPORTANT: Review every condition carefully before you create the rule. Depending on the selected operator, a rule can block most website traffic instead of only the requests that you intended to restrict.

NOTE: Access rules block requests only when all configured conditions match the same request.

NOTE: Rule changes take effect within 5 minutes.

Work with condition operators

The available operators depend on the selected field. Depending on the condition type, you can use operators such as contains, equals, matches, is in, and is not in.

For fields that support multiple values, add all required values to the same condition. For example, you can create a Country condition that contains several countries.

Edit or delete an access rule

To modify or remove an existing rule, perform the following:

1. On the Access rules page, locate the rule that you want to change.
2. Open the More actions menu for the rule.
3. To modify the rule, click Edit rule, update the configuration, and complete the review step.
4. To remove the rule, click Delete rule and confirm the action.

NOTE: Rule changes take effect within 5 minutes.

Filter access rules

To narrow the list of rules, perform the following:

1. Use the filter box at the top of the page to search by rule name.
2. Use the Environment filter to display rules assigned to one or more environments.
3. Clear the selected filters to return to the full list.

Additional resources

• Security - provides mechanisms for securing your project on application level and infrastructure level
• Edge rules in Sitefinity Cloud - how to use custom edge rules for request and response transformations at the CDN layer instead of request blocking