Rules across many domains: structure before you scale

Rules across many domains: structure before you scale

One domain is easy. Fifteen domains with slightly different rules is a maintenance nightmare unless you plan the layering.

A structure that holds up:
— Account-level rules for everything universal: known bad ASNs, obvious scanner paths, global rate limit floor.
— Zone-level rules only for what is specific: the checkout path on the shop domain, the API limits on the API domain.
— Naming convention for every rule: purpose, scope, date. "Block empty UA" tells you nothing in six months. "Login RL 10/min — 2026-03" does.

Keep a plain text file with every rule expression. When something breaks on domain seven, you want to compare it with domain three without clicking through two panels.

And test with one zone first. Roll a new account-level rule into log mode, check the events across all zones, then switch the action. A rule that looks fine on the marketing site can wreck the API domain.