Traffic rules that fit your store: locations, networks, and repeat offenders

A scoring engine judges each visit on its evidence. Sometimes you already know something the engine can’t: you don’t ship to a region, a network keeps causing chargebacks, or one visitor keeps retrying after being blocked. Traffic rules let you encode that.

Where rules help

• Country rules for markets you don’t serve.
• State, city, and ASN rules for finer control, such as a hosting network that only ever sends abuse.
• VPN and Tor blocking if anonymizing networks cause problems for your store. Use it carefully, since some real shoppers use them.
• IP rules for allowing or blocking specific addresses and ranges.

Repeat-offender blocking

Attackers rarely stop after one attempt. A repeat-offender rule temporarily blocks a visitor after a set number of blocked visits inside a time window. This slows retry-heavy attacks without you maintaining a list by hand.

Choose how to challenge

Not every risky visit needs a hard block. You can pick a silent background check, an interstitial screen, Cloudflare Turnstile with your own site key, or passive tagging that records the visit and lets it through. Passive mode is a good way to see what a rule would catch before you enforce it.

Rules and scores work together

A rule is a blunt tool and a score is a careful one. Use rules for what you know, and let the scoring engine handle what you don’t. Read more about bot protection.