Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settings
Security
Security overview and big screenAttack logCC protectionWAFLists and access controlBots and scannersPaid protection add-ons
Analytics and alerts
StatisticsAccess logsAlerts and notifications
Accounts and licensing
Users and plansLicenses and add-ons

Attack log

About 4 minUpdated 2026-10-28

Security Center › Attack Log lists requests that the WAF blocked or challenged, and IPs that were banned automatically or manually. Events are kept for 7 days, and bans unlock automatically when they expire.

Console · Attack Log
Attack log list

How to read it

  • Filter by site, time, attack type and action (block, challenge, log only).
  • Click an entry for details: the rule that matched, request path, source IP and its location.
  • Banned IPs also show up here and can be unbanned manually.

Wrongly blocked?

  1. In the event details click "Add to allowlist" to put the IP into this site's IP allowlist (all paths and rules).
  2. If a rule is giving a false positive rather than one IP, add an exception in the WAF settings; see WAF.
Caution Bot, upload scan, tamper protection and leak protection events cannot be allowlisted yet; an event with no owning site cannot be added to a site allowlist either.

Export

You can export by the current filter. Cache purge, prefetch, unlock and log download have daily limits.

For overall trends from a statistics view, see Statistics.