docs
  1. Storefront Hosting
  2. Operate
  3. Firewall Insights

Firewall Insights

Overview

Firewall Insights shows the Cloudflare edge traffic reaching your Storefront Hosting environment. Use it to understand your incoming traffic, identify abusive sources, and shape your Firewall rules based on actual data.

Firewall Insights lives in the SCAYLE Panel under Shops ➜ [Shop] ➜ Hosting ➜ Observability ➜ Firewall Insights.

If your own edge is in front of Storefront Hosting, the client IPs, countries, and bot classes shown here reflect your edge's traffic to SCAYLE, not individual visitors. All traffic appears to come from your edge's IPs. See Bring Your Own Security for the full topology.

Firewall Insights page in the SCAYLE Panel, showing the Country, Action, and Bot class filters, six KPI cards (Total requests, Allowed, Allowed by rule, Blocked, Challenged, Rate limited), and the Traffic Over Time chart grouped by Action for the last 3 days.

Firewall Insights at a glance - filters, KPI cards, and Traffic Over Time.

Required permission

Reading Firewall Insights requires the View firewall insights permission (storefront-platform__security_rules__insights__read), listed under Security Rules in the SCAYLE Panel's permission settings.

Controls

Firewall Insights has shared controls at the top of the page:

  • Environment selector (top right) - switch between environments.
  • Timeframe selector (top right, next to the environment selector) - choose the time window. Options: Last hour, Last 24 hours, Last 3 days, Last 7 days, Last 30 days.

Filters

A filter bar lets you narrow the data shown across all charts and tables:

  • Country - one or more countries. Multi-value.
  • Action - what the Firewall did with the request (Allowed, Allowed by rule, Blocked, Challenged, Rate limited). Multi-value.
  • Bot class - the bot classification Cloudflare assigned to the request. Multi-value. Observed values include Human, Likely human, Likely automated, Automated, and Verified bot. Of these, Automated and Likely automated can be targeted directly with a Bot score Security Rule.

Changing any filter updates every chart and table on the page.

KPI cards

Six KPI cards show totals for the selected time range, each compared to the previous period of the same length (so when "Last 24 hours" is selected, the arrow and percentage compare the past 24 hours to the 24 hours before that).

CardWhat it counts
Total requestsEvery request Cloudflare processed for the environment.
AllowedRequests that matched no Firewall rule and reached your storefront.
Allowed by ruleRequests explicitly allowed by a Skip rule and reached your storefront.
BlockedRequests blocked by a Firewall Security Rule.
ChallengedRequests that were presented a Managed Challenge.
Rate limitedRequests acted on by a Rate Limiting rule. Counted here whatever the rule's action (Block or Managed Challenge).

The five outcome cards (Allowed, Allowed by rule, Blocked, Challenged, Rate limited) sum to Total requests - every request counts in exactly one of them.

Traffic Over Time

A stacked bar chart showing request volume over the selected time window. By default the chart groups by Action (Allowed, Allowed by rule, Challenged, Rate limited, Blocked), so you can see at a glance how much traffic each outcome represents.

The Group by dropdown in the top right lets you re-group the chart by:

  • Action
  • Country
  • Device type
  • Client IP
  • Hostname
  • Bot class

Top lists

Three top lists below the chart show the most active entities for the selected time range. Each list has a Create a rule in Firewall settings → link so you can jump straight to the Firewall page to add a rule based on what you see.

Top lists section of Firewall Insights, showing Top IPs with country, network, bot class, and request counts; Top Countries with Automated and Blocked shares; and Top Paths with request counts and Blocked and Rate limited shares.

Top IPs, Top Countries, and Top Paths - each list has a Create a rule in Firewall settings shortcut.

Top IPs

Client IPs with the most requests. Each row shows the IP, country, network (ISP or ASN), bot class, request count, and the shares of traffic Blocked and Rate limited.

Top Countries

Countries with the most requests. Each row shows the country, request count, share of Automated traffic, and share Blocked.

Top Paths

Paths with the most requests (static assets excluded). Each row shows the path, request count, share Blocked, and share Rate limited.

Examples

The following examples show how to go from what you see in Firewall Insights to the Firewall rule that acts on it.

Firewall rules are only available in live environments. If you are looking at Insights for a non-live environment, you can review the traffic but cannot create a rule here. See the Firewall page for details on availability.

Identify and block a scraper from the Top IPs list

Scenario: The Top IPs list shows a single client IP with over 50,000 requests in the last 24 hours, flagged as Likely automated, from a cloud provider (for example, 198.51.100.1 from Amazon.com, Inc.). You don't recognize the IP and it's not one of your own services.

What to do:

  1. Click Create a rule in Firewall settings → at the bottom of the Top IPs list.
  2. In the Firewall page, add a new Security Rule with:
    • Name: Block scraper 198.51.100.1
    • Match type: IP / CIDR
    • Entry: the IP you saw (for example, 198.51.100.1)
    • Action: Block
  3. Click Save changes in the dialog, then Save changes at the top of the Firewall page to propagate the rule to the edge. See Saving changes for details.

Future requests from that IP are blocked at the edge and never reach your storefront.

Tip: If you already have an IP / CIDR Block rule, add the IP to that rule's entries instead of creating a new rule. Each live environment supports up to 5 Security Rules, and each IP / CIDR rule can hold up to 50 IPs.

Rate limit a path under heavy load

Scenario: Top Paths shows /api/rpc/getBasket is receiving high overall traffic, and when you filter to it and group Traffic Over Time by Client IP, a few clients each send far more than 60 requests per minute - well above typical shopper behavior. You want to throttle those abusive clients without hard-blocking real users who stay under the threshold.

What to do:

  1. Click Create a rule in Firewall settings → at the bottom of the Top Paths list.
  2. Add a Rate Limiting rule with:
    • Name: Throttle /api/rpc/getBasket
    • Match type: Path
    • Path pattern: /api/rpc/getBasket
    • Max requests: 60
    • Window: 1 min
    • Action: Managed Challenge
  3. Click Save changes in the dialog, then Save changes at the top of the Firewall page to propagate the rule to the edge. See Saving changes for details.

Clients under 60 requests per minute to this path are unaffected. Clients above the threshold are presented with a challenge until the window resets.

Spot and challenge an automated bot surge

Scenario: You group Traffic Over Time by Bot class and notice a large block of Automated traffic coinciding with a flash sale announcement - likely scrapers watching for inventory or discounts.

What to do:

  1. Open the Firewall page (Shops ➜ [Shop] ➜ Hosting ➜ Settings ➜ Firewall).
  2. Add a Security Rule with:
    • Name: Challenge automated bots
    • Match type: Bot score
    • Score: Automated
    • Action: Managed Challenge
  3. Click Save changes in the dialog, then Save changes at the top of the Firewall page to propagate the rule to the edge. See Saving changes for details.

Automated bots are presented with a CAPTCHA; real customers pass silently.

  • Firewall - the Security Rules and Rate Limiting that act on this traffic.
  • Security Rules - block, challenge, or allow based on IP, country, or bot characteristics.
  • Rate Limiting - throttle high-volume traffic.
Previous
Request Headers
Next up
Secure