---
layout: article
title: Firewall
description: Protect project APIs, Functions, and Sites with Appwrite Firewall. Create rules to deny, challenge, rate limit, redirect, or bypass matching traffic from the Console.
---

Appwrite **Firewall** is project-level traffic control. You define rules that match requests by attributes such as IP address, hostname, path, HTTP method, headers, query parameters, user agent, or location, then apply an action before traffic reaches your [API](/docs/apis/rest), [Functions](/docs/products/functions), or [Sites](/docs/products/sites).

You manage rules under **Firewall** in your project. A rule applies to the project API, to one function, or to one site. Before you save, the Console previews how many recent requests would match. After, the traffic overview shows request volume and each Firewall outcome.

![Firewall page with traffic overview and rules](/images/docs/firewall/traffic-overview.avif)

**Appwrite Cloud**

Firewall is available on Appwrite Cloud. Rule limits depend on your organization plan (see [Plan limits](/docs/products/firewall/rules#plan-limits)).

# How it works

Each Firewall rule has four parts:

1. **Resource type**: Which traffic the rule considers. Choose the project **API**, one **Function**, or one **Site**. See [Resource scopes](/docs/products/firewall/scopes).
2. **Conditions**: Filters on request attributes (for example IP equals a value, path starts with `/v1/account`, country equals `US`). All conditions on a rule must match (AND). A rule with no conditions matches every request in its scope.
3. **Action**: What happens when the conditions match. One of **Deny**, **Bypass**, **Challenge**, **Rate limit**, or **Redirect**.
4. **Priority**: Lower numbers are evaluated first. The first matching enabled rule decides the outcome for that request and stops evaluation.

# Console access

Firewall never blocks the Appwrite Console, so you cannot lock yourself out. Firewall checks everything else, including your own SDK calls and requests made with an API key.

Rules on a **Site** or a **Function** run at the network edge, which cannot tell your browser from anyone else's. A site challenge, or [Attack mode](/docs/products/firewall/attack-mode), challenges you too.

# Get started

Create your first API-scoped deny rule and confirm outcomes in traffic overview.

[Quick start](/docs/products/firewall/quick-start)

# Concepts

Core ideas behind Firewall rules, matching, and evaluation.

- [Rules](/docs/products/firewall/rules): What a rule contains, enabled state, plan limits, and how rules appear in the Console.
- [Actions](/docs/products/firewall/actions): Deny, bypass, challenge, rate limit, and redirect, including status codes and rate-limit keys.
- [Conditions](/docs/products/firewall/conditions): Request, client, and location attributes, operators, AND matching, and CIDR and geo details.
- [Resource scopes](/docs/products/firewall/scopes): API, Functions, and Sites scopes and where each is enforced.
- [Priority](/docs/products/firewall/priority): Evaluation order, first-match behavior, and tips for stacking rules safely.
- [Traffic overview](/docs/products/firewall/monitor): The metrics Firewall reports, and what the impact preview can estimate.

# Guides

Step-by-step guides for common Firewall policies in the Console.

- [Block traffic by country](/docs/products/firewall/block-countries): Deny project API traffic from specific countries, or serve only the countries you allow.
- [Allowlist trusted IP addresses](/docs/products/firewall/allowlist-ips): Pair a bypass rule with a deny rule so only trusted IP addresses reach a protected path.
- [Rate limit authentication traffic](/docs/products/firewall/rate-limit-auth): Set a request quota on authentication paths to slow brute-force attempts.
- [Challenge automated traffic](/docs/products/firewall/challenge-bots): Verify suspected bots with a challenge before their requests continue.
- [Redirect a site for maintenance](/docs/products/firewall/site-maintenance): Send visitors of a site to a maintenance page and back without a new deployment.
- [Attack mode](/docs/products/firewall/attack-mode): Challenge every visitor to a site with one click during an incident.