Rules run in a fixed order for every request. The first rule that fails sends the visitor to the safe page. Everything else falls through to your destinations.
Pipeline order
- Bot signatures (curated + custom UA / header patterns)
- ASN reputation (datacenter / VPN / mobile / residential)
- Geo, language, device, browser, OS filters
- VPN / ISP filter
- Click-limit filter (per IP, sliding window)
- Engagement gates (mouse-move, cookie overlay, PrePage)
- Fingerprint clustering
- Intelligent traffic assessment (plan-gated)
- Rotation → destination pick
Rule types
| Type | Operator | Example value |
|---|---|---|
| geo | in / not_in | ["US","CA","GB"] |
| language | in / not_in | ["en","es"] |
| device | eq | "mobile" |
| os | in | ["ios","android"] |
| browser | in | ["chrome","safari"] |
| ua_regex | match | "^(?!.*bot).*$" |
| referrer | contains | "facebook.com" |
| asn | in / not_in | [15169, 8075] |
| ip_cidr | in / not_in | ["203.0.113.0/24"] |
| ip_blacklist | match | stored list |
| vpn | eq | false |
| click_limit | lte | { per: "ip", window: "1h", max: 3 } |
| time_window | between | { tz:"UTC", from:"09:00", to:"22:00" } |
| cookie_overlay | required | true |
| mouse_move | required | true |
| vendor_block | platform claim or selected ad source | { vendors:["meta"], block_ad_traffic:true, block_moderation:true } |
Editing rules
Open Sites → your site → Rules. Add, reorder (drag), enable/disable individually, and test with the built-in simulator. Every save is recorded in the audit log and takes effect within one second.
Presets
A preset is a reusable bundle of rules — for example "Tier-1 only", "No datacenter", or "Facebook ads whitelist". Manage presets from Dashboard → Presets and attach them to any site. Presets stack on top of per-site rules; the effective ruleset is the union.
Advanced: writing rules by hand
Every rule is stored as JSON in site_rules.rules. You can bulk-import via Portability → Import:
[
{ "type": "geo", "op": "in", "value": ["US","CA","GB"] },
{ "type": "asn", "op": "not_in", "value": [15169, 8075, 14061] },
{ "type": "vpn", "op": "eq", "value": false },
{ "type": "click_limit", "op": "lte",
"value": { "per": "ip", "window": "1h", "max": 5 } }
]Anti-intelligence vendor blocking
If a tenant wants to protect campaign intelligence from platform-claimed crawlers, add avendor_block rule with selected vendors such as Google, Meta, Amazon, Microsoft, TikTok, LinkedIn, or Cloudflare. For tenant presets, enableBlock platform authority & search bots to block corroborated Meta, Google, Amazon, and known search-engine authority/crawler visits from the protected product page. The evaluator combines vendor identity with normal referrer/source, country, device, header, and client-evidence context. Genuine visitors arriving through Meta or Instagram ads remain welcome; ad origin is not itself a bot signal. Blocked automation receives the configured non-sensitive safe-page fallback or a hard denial according to the delivery policy. Decisions record preset:authority_block, meta:moderation_blocked, orspy:platform_claim_blocked for audit and review.
Bot signatures
ShieldGate ships with a curated list covering Google, Meta, Microsoft, VirusTotal, common security scanners, AI scrapers, SEO bots, and headless automation (Puppeteer / Playwright / Selenium). Admins can add custom signatures under Admin → Signatures.