Bot shield
Every public app gets visits from bots looking for weak spots. The bot shield blocks a visitor who does that, for a while, before the visit reaches your app. It is on for every app from the start.
What it blocks
- A visitor who asks 3 times in 10 minutes for a path bots look for, like
/.env,/.git/,/wp-login.php,/wp-adminor/phpmyadmin, and your app doesn't answer it: blocked for 1 hour. An app that really serves one of these paths never blocks its own visitors. - A visitor whose sign-in fails 10 times in 10 minutes (a POST answered 401 or 403, by your app or by its password page): blocked for 15 minutes.
A blocked visitor sees "This address is blocked for a while. Try again later." on that app until the block ends. Visitors on your own Tailscale network are never blocked. An IPv6 visitor counts by its /64.
See who is blocked
$ secretbase blocked my-app No blocked visitors.
With visitors blocked, it lists each address, the rule in words and until when, then Let one back in: secretbase unblock my-app <address>. On the dashboard: the app's Settings, Bot shield, Blocked visitors, with Unblock next to each.
Let someone back in
$ secretbase unblock my-app 203.0.113.7
It says "203.0.113.7 can visit my-app again." Use it when the shield blocked someone who should get in, for example you.
Turn it off or on
$ secretbase shield my-app off The bot shield is off for my-app: no visitor is blocked, and those who were can visit again. $ secretbase shield my-app on The bot shield is on for my-app: a visitor who looks for hidden files or keeps failing to sign in is blocked for a while.
Recommended: on. Turning it off lets every blocked visitor back in.
If something goes wrong
- "That address isn't blocked on this app; its block may have ended already.":
secretbase blocked my-appshows who is blocked now. - "That isn't a visitor's address.": use one from the list, like
203.0.113.7or2001:db8:1:2::/64.