Challenge, block or log: picking the right action for a rule

Challenge, block or log: picking the right action for a rule

The action you attach to a rule matters as much as the expression. Here is how to choose.

Log. Use it first, always. It writes matches into analytics without touching traffic. Run a new rule in log mode for 24–48 hours and read the sample of matched requests before doing anything else.

Managed challenge. The default for "probably a bot, but I'm not sure". It decides on its own whether to show an interactive check or let the visitor through silently. Cheap on real users, expensive on scripts.

JS challenge. Requires JavaScript execution. Kills curl-style scrapers, but also kills legitimate API clients and monitoring tools. Don't apply it to endpoints that machines are supposed to call.

Block. Only for patterns you have verified. A block on a false positive gives the visitor nothing but an error page and no way to prove they are human.

The order of thinking: log, then challenge, then block. Skipping steps is how you end up debugging support tickets.