Control traffic before it reaches your app_
Define project rules that match the request properties you care about, then deny, bypass, rate limit, redirect, or challenge traffic before it hits your API, Functions, or Sites.
Deny, bypass, rate limit, redirect, or challenge
Every rule applies one action when conditions match. Deny abusive traffic, bypass trusted clients, throttle per IP, redirect to maintenance URLs, or challenge suspicious requests before they continue.
One action per matching rule. Evaluation stops at the first match.
Deny
Reject matching requests before they reach your project.
Bypass
Allow the request and skip later Firewall rules.
Rate limit
Throttle matching requests that exceed a per-IP quota.
Redirect
Send matching clients to another location with a 3xx status.
Challenge
Present a challenge before allowing suspicious clients through.
Match on rich request attributes
Build rules from the request properties that matter to your app. Combine conditions so a rule only fires when every filter matches.
Rule conditions
Every condition on a rule must match before the action runs.
203.0.113.10/v1/accountUnresolvedMatch on request properties such as identity, location, path, and client signals.
Scope rules to API, Functions, or Sites
Apply policies to the project API, a specific Function, or a specific Site. Keep production APIs locked down while preview sites and health checks stay reachable.
Resource scope
Choose where the rule evaluates matching traffic.
API
Project REST and GraphQL endpoints.
projectFunctions
A specific Function execution endpoint.
fn_checkoutSites
A specific Site deployment hostname.
site_storefrontPriority decides the first match
Lower priority numbers evaluate first. Place bypass allowlists ahead of broader deny, rate limit, or challenge rules so trusted traffic skips the rest of the chain.
Rule priority
Lower numbers evaluate first. The first match stops the chain.
Office IP allowlist
BypassFirst matchPriority: -10
Deny account mutations
DenySkippedPriority: 0
Rate limit public API
Rate limitSkippedPriority: 10
Preview impact before you enable
Estimate how much recent traffic a draft rule would affect, then refine conditions before you turn it on.
Estimated impact
See how much recent traffic a draft rule would affect.
Matched
3,352
Monitor denied, limited, redirected, and challenged traffic
Track request volume alongside denied, rate-limited, redirected, and challenged outcomes on the Firewall page. Confirm policies after enablement without leaving the Console.
Passed
Denied
Challenged
Rate limited
Redirected
Block rate
FAQ_
Firewall rules run on Appwrite Cloud before traffic reaches your project resources. Scope a rule to the project API, a specific Function, or a specific Site. Console traffic is never blocked, so you can keep managing rules even when deny or rate limit policies are active.
Start protecting with Firewall_
Create your first deny, bypass, rate limit, redirect, or challenge rule from the Console and preview impact before you enable it.
Explore Appwrite_
Modular backend services that share the same project, permissions model, and console.