Each website’s Security tab writes nginx rules for that site only. Saving reloads nginx; workers keep running.
Hide from search engines
Sends X-Robots-Tag: noindex, nofollow on every response and serves a robots.txt that disallows everything (unless your nginx file already serves one). Use it for staging sites, admin panels, and APIs.
Refuse known crawlers
Answers 403 to search engine, SEO, and AI crawlers: Googlebot, Bingbot, Yandex, Baidu, Ahrefs, Semrush, GPTBot, ClaudeBot, CCBot, Bytespider, and more. Link previews in Telegram, WhatsApp, Slack, and Facebook keep working.
Basic auth
Asks for a username and password before anyone can open the site. Add paths that stay open (one per line, prefix match), for example APIs and webhooks that servers call without a browser:
/.well-known/acme-challenge/ is always open. The password is stored as a SHA-512 crypt hash for nginx, plus encrypted so you can reveal it later with your 2FA code.
Blocked IPs
IPs and CIDR ranges (IPv4 or IPv6), one per line, answered with 403:
Blocking uses the visitor’s real IP, also behind a Cloudflare tunnel (CF-Connecting-IP is trusted only from the local tunnel). You can block an attacker in one click from Monitoring → Security.
For blocking at Cloudflare’s edge (before traffic reaches your server), add the IP to a WAF rule in the Cloudflare dashboard.
