IP address blocking

Each configuration can refuse traffic from addresses you choose. Visitors from those addresses are never issued a challenge, so their requests never reach you.

Blocking an address

Open a configuration in your dashboard, choose Edit, and add one address or CIDR range per line under Blocked IP addresses. IPv4 and IPv6 are both accepted, and a bare address blocks only itself.

bash

# A single address
203.0.113.4

# An IPv4 range, in CIDR notation
198.51.100.0/24

# IPv6 works the same way
2001:db8::/32

What a blocked visitor sees

The challenge request is refused, so challenge() rejects and nothing is sent. Blocked requests do not count towards your monthly allowance.

Choosing what to block

Prefer single addresses to ranges. Mobile carriers, universities, offices and VPNs put many unrelated people behind very few addresses, so blocking one of those ranges turns away everyone behind it, while whoever you meant to stop moves to another address in minutes.

Blocking suits a specific, persistent source you can already identify. Everyday spam is better left to the challenge itself, which costs a genuine visitor a moment rather than their access.