Bot protection

Bot protection

Bot protection is an optional per-hosting toggle that adds three things to the web server at once: a request-rate limit per client IP, a denylist of user-agents belonging to known scanners, and a denylist of paths that are never served. It is off by default on every hosting.

Where to turn it on

In https://panel.cloudweb.sk open the hosting and, on the Overview tab, find the Bot protection card with an "Enabled / Disabled" toggle. The change can be made by the hosting owner or a collaborator with the "Configuration" permission (see collaborators). After toggling it, the hosting is reconfigured in the background – you get a short confirmation notification, and the change takes effect without downtime.

What it actually does

• Request-rate limit – nginx hostings only (Apache does not get this part, see below): 15 requests per second per client IP, with a short burst allowance of 30 extra requests. A client that goes over gets 429 Too Many Requests.
• User-agent blocking – a request whose User-Agent header contains the string of a common scanning tool (for example sqlmap, nikto, nmap, masscan, nuclei, acunetix, netsparker, wpscan, dirbuster, gobuster, feroxbuster, fimap, zgrab, l9explore or httrack) gets 403 Forbidden. This works on both nginx and Apache hostings.
• Sensitive-path blocking – regardless of the user-agent, a 403 is always returned for paths that typically hold secrets or configuration: .env, .git/, .svn/, .hg/, .aws/, composer.json/composer.lock, config files of common JS build tools (next/nuxt/vite/webpack/svelte/tailwind/rollup/babel/jest/vue), Jenkinsfile, Dockerfile, docker-compose.yml, settings.py, .htpasswd, id_rsa, and files with the extension .sql, .sqlite, .sqlite3, .bak, .backup, .dump, .swp, .save, .pem, .key, .p12 or .pfx. This rule also applies to both nginx and Apache hostings.

What to watch out for

• These are exact matches on the path and the user-agent – if your application legitimately serves a file with such a name or extension (for example a publicly downloadable export.sql backup), protection blocks it just like it would block an attacker. In that case either turn protection off, or move/rename the file out of the web-served path, for example using the file manager.
• The 15 req/s limit with a 30-request burst is tuned for normal browsing, not for automated API clients or monitoring tools calling from a single IP at high frequency – those may occasionally see 429. The limit is counted separately per client IP.
• Protection is deliberately opt-in (off by default) – turn it on if your site does not need public access to such files and paths.