Rules
Rule templates: block VPN, Tor, bots and more without code
Rules turn what we learn about a visitor into a decision your project applies, without code on your side. A rule says: when these conditions match, allow, ask for a human check, or deny. These templates are the starting points in the console rule editor; add one, change the numbers and countries, and test it on a real event before you switch it on.
How rules work
A project has one ordered list of rules. The first enabled rule that matches decides, and the rest are not looked at. A condition on something we could not determine never matches, so a rule does not fire on a guess.
Before you switch rules on, run your unsaved list against a stored event in the console: it shows which rule would decide and which others would also match. Nothing is saved or enforced by a test.
Deny Tor
Refuse visitors who connect through the Tor network.
{
"name": "Deny Tor",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "tor",
"op": "eq",
"value": true
}
],
"action": "deny"
}Human check for VPN
Ask visitors on a VPN to pass a human check first.
{
"name": "Human check for VPN",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "vpn",
"op": "eq",
"value": true
}
],
"action": "human_check"
}Human check for datacenter networks on a new device
Ask first-time devices that come from a hosting network to pass a human check.
{
"name": "Datacenter network, new device",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "ipKind",
"op": "eq",
"value": "hosting"
},
{
"field": "isNew",
"op": "eq",
"value": true
}
],
"action": "human_check"
}Deny blocklisted IPs
Refuse visitors whose IP address is on a public blocklist.
{
"name": "Deny blocklisted IP",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "blocklisted",
"op": "eq",
"value": true
}
],
"action": "deny"
}Human check for tampered browsers and virtual machines
Ask visitors with a modified browser or a virtual machine to pass a human check.
{
"name": "Tampered browser or virtual machine",
"enabled": true,
"match": "any",
"conditions": [
{
"field": "tampered",
"op": "eq",
"value": true
},
{
"field": "virtualMachine",
"op": "eq",
"value": true
}
],
"action": "human_check"
}Deny too many IPs in one hour
Refuse visitors seen from more than five different IP addresses in the last hour. Change the number to suit you.
{
"name": "Too many IPs in 1 hour",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "velocityIps1h",
"op": "gt",
"value": 5
}
],
"action": "deny"
}Only allow selected countries
Refuse visitors from any country that is not on your list. Edit the list after adding.
{
"name": "Only allowed countries",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "country",
"op": "not_in",
"value": [
"US",
"CA",
"GB"
]
}
],
"action": "deny"
}Deny automated bots
Refuse visitors that look like automation tools.
{
"name": "Deny bots",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "bot",
"op": "eq",
"value": true
}
],
"action": "deny"
}Rooted or jailbroken device → human check
Ask visitors on a rooted Android or jailbroken iOS device to pass a human check. Applies to events from the mobile SDKs only.
{
"name": "Rooted or jailbroken device",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "rooted",
"op": "eq",
"value": true
}
],
"action": "human_check"
}Spoofed location → deny
Refuse visitors whose device location is being faked by software. Applies to events from the mobile SDKs only.
{
"name": "Spoofed location",
"enabled": true,
"match": "all",
"conditions": [
{
"field": "locationSpoofed",
"op": "eq",
"value": true
}
],
"action": "deny"
}Add a template
In the console, open your project, Rules, and choose From template. The rule is added to your list; edit it, drag it into position and save.
Frequently asked questions
Can a rule hand someone a second free trial?
No. An allow rule skips only the first-claim network and trust checks, and it cannot override claim limits. In a shared-device class the human check still runs. Device, email and household limits still apply.
Do I see which rule caught a visitor?
You do: events and webhooks carry the rule that decided. The visitor never learns which rule it was.
Do rules apply to visitors already identified?
A change applies to identifications made after you save it. Ones already issued live for ten minutes at most.
Try it on your own sign-up flow
Every new account gets 2,000 free checks. No card required.