---
layout: article
title: Traffic overview
description: The metrics Appwrite Firewall reports for project traffic, and what the rule impact preview can estimate.
---

Firewall gives you two views of your rules. Use the **impact preview** to size a rule before you create it, and the **traffic overview** to see what it did after.

# Traffic overview

Open **Firewall** in your project. Above the rules list, the overview chart and metrics summarize recent traffic for the selected date range and interval.

![Firewall traffic overview chart and metrics](/images/docs/firewall/traffic-overview.avif)

Series include:

| Series | Meaning |
|--------|---------|
| **Passed** | Every request that reached your project API, whatever Firewall then did with it, plus edge requests Firewall allowed |
| **Denied** | Requests rejected by a deny action (`403`) |
| **Challenged** | Requests challenged by a [challenge action](/docs/products/firewall/actions#challenge), including [Attack mode](/docs/products/firewall/attack-mode) on a site |
| **Rate limited** | Requests throttled over a rate limit quota (`429`) |
| **Redirected** | Requests answered with a redirect action |

**Block rate** is denied plus rate limited, as a share of that count.

Bypassed requests and under-quota rate-limited requests have no series of their own. Both are allowed, so they appear under **Passed**.

**API rules are counted twice**

A request that an **API** rule denies, challenges, rate limits, or redirects still counts under **Passed**, because it reached your project before Firewall stopped it. The headline total counts that request in two series.

Rules on a **Function** or a **Site** stop the request at the edge, so Appwrite counts those requests once.

Use the date range picker and interval controls to zoom into an incident, or drag across the chart to select a range.

The chart follows the resource selector above the rules list: **API** shows project API traffic, and a selected **Site** or **Function** shows traffic for that resource only.

# What the metrics tell you

If **Passed** is high and **Denied** is flat, check that the rule is enabled, that no bypass rule with a lower priority number catches the traffic first, and that the rule's conditions match your live traffic.

If **Rate limited** climbs with normal load, raise the limit, lengthen the interval, or narrow the conditions.

# Impact preview

When you create or edit a rule, the wizard sidebar estimates how many recent requests would have matched. Use it to tighten a broad path or country filter before you turn on deny, and to size a rate limit quota against real volume.

The estimate covers IP address, path, method, country, continent, state, city, hostname, operating system, browser, and user agent. With the [premium Geo DB addon](/docs/products/firewall/conditions#premium-geo-db), it also covers ISP, AS number, AS organization, connection type, connection usage type, and connection organization.

When a condition uses an attribute that usage can break down, the wizard also charts the top values seen in recent traffic for that attribute, scoped to the rule's resource. Use these charts to pick country codes, ISP names, paths, and similar values. Premium city and network breakdowns require the addon; without it the charts show an upgrade prompt. Attributes with no usage breakdown, such as **Continent** and **State**, still contribute to the match estimate but do not get a distribution chart.

A rule that uses **Header**, **Query parameter**, **Query parameter name**, **Protocol**, **Accept**, **Accept-Language**, **Cookie**, or other attributes without usage data, a **does not contain** condition, or more than eight estimable conditions shows **Preview unavailable** instead of a number. The rule still enforces every condition. IP addresses are compared as text, so a CIDR range shows zero matches. The rule still matches every address in the range.

To confirm which rule handled a request once the rule is live, read the `X-Appwrite-WAF-Rule` response header. See [Find out which rule fired](/docs/products/firewall/actions#which-rule-fired).

[Rate limit authentication traffic](/docs/products/firewall/rate-limit-auth)