Captcha challenge

If HAProxy is enabled on your account, you can use our Captcha to challenge traffic based on its origin. This lets you protect your application against unwanted bots and crawlers.

How it works

Using HAProxy, you can challenge traffic with an image captcha. When configured, you can choose to challenge traffic based on IP address, AS number/name, country or continent of origin, or User Agent. It also includes a lockdown mode that challenges everyone — useful when you're under attack and need time to investigate.

In the HAProxy config folder ~/.config/haproxy you will find challenge.lst. Here you can add what or who you want to challenge. challenge.lst.example shows how to set up challenge.lst.

We maintain a list of good-bot User Agents, such as the Google SEO bots, that are excluded from the challenge by default.

Setting up the challenge.lst

To add or remove a challenge criteria, simply edit ~/.config/haproxy/challenge.lst and reload HAProxy with systemctl --user reload haproxy after your changes.

To inspect your traffic, use our CLI tool dbug.

You can find the alpha-2 codes here.

challenge.lst.example

# use dbug traffic:stats (--until-minutes-ago=) to analyze traffic
# use systemctl --user reload haproxy to apply
# we have an exclude list for goodbot useragents, useragents from this list can not be challenged
# Please note, in the challenge.lst file, commenting lines with # does not work, they are still used

# Emergency: challenge everyone
lockdown

# Countries to always challenge
country:CN
country:RU
country:IR
country:KP

# Continents to always challenge
continent:AF
continent:AS
continent:SA

# ASN numbers to always challenge
asn:13335
asn:16509
asn:15169

# ASN organizations to always challenge
asn_name:Datacamp Limited
asn_name:Amazon
asn_name:Google

# Challenge outdated User-Agents (browsers > 1 year old)
old_browsers

# Specific User-Agent strings (exact match) to challenge
useragent:curl/7.81.0
useragent:Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36

# ip addresses (IPv4 or IPv6)
ip:1.2.3.4
ip:2001:db8::1