Skip to main content

Firewall settings

The Clonable firewall lets you manage which traffic can access your Clones. Open your site's settings and go to Firewall settings.

Firewall settings with the WAF level slider and IP allowlist and blocklist

Allowing and blocking IP addresses​

On this screen, you can manage the lists for your site:

  • Allowlist (whitelist): IP addresses you want to allow.
  • Denylist (blacklist): IP addresses you want to block.

Both lists also support IP ranges in CIDR notation. For example, 192.0.2.0/24 adds the entire range from 192.0.2.0 to 192.0.2.255. This lets you allow or block a whole range without entering each IP address separately.

Clonable administrators can also manage global IP allowlists and denylists. Contact Clonable support if an IP address remains blocked after you change your site's settings.

Check order and precedence​

Clonable checks requests in this order:

  1. Additional firewall: analyses the request for suspicious characteristics. This check takes place before the allowlists and blocklists.
  2. Global allowlist: managed by Clonable administrators. Some known bots, such as Google's, are added automatically.
  3. Global blocklist: automatically populated from a central database and also managed by Clonable administrators.
  4. Site allowlist: the IP addresses and CIDR ranges you allow yourself.
  5. Site blocklist: the IP addresses and CIDR ranges you block yourself.
  6. Intelligent bot protection: evaluates traffic for suspicious bot behaviour. The configurable WAF level determines how strict this protection is.

An allowlist takes precedence over the checks that follow it. A global allowlist entry therefore also takes precedence over your site's blocklist. If an IP address is on the global blocklist, your site's allowlist cannot override that block. Within your own site, the allowlist takes precedence over the blocklist.

The additional firewall is always checked first. An allowlist entry therefore does not bypass this check.

WAF level​

The WAF (Web Application Firewall) level determines how strictly the intelligent bot protection checks traffic. Use the slider at the top of the Firewall settings screen to adjust the level.

Additional firewall and 403 errors​

Alongside the configurable firewall, Clonable uses an additional firewall that you cannot configure yourself. Changing the WAF level on this screen does not change this additional protection.

Exceptions to this check are possible, but require custom changes by Clonable. You cannot add them yourself through the firewall settings or an allowlist.

This firewall can block a request to your Clone and display a 403 Forbidden error page. If this happens, contact Clonable support and include the corresponding error page, for example as a screenshot, so we can investigate the block.

Is your hosting provider blocking Clonable?​

The lists above concern visitors to your Clones. If your hosting provider blocks Clonable's servers, follow Preventing IP blocking.

Last updated on