Control
Decide which IPs reach your origin
ArxLayer lets you allow, deny, and greylist IP ranges at domain, account, and platform scope, each with a TTL. Reputation is shared across your fleet, and a platform hard-deny stops known-bad traffic that no tenant rule can override.
The problem
Bad IPs hit every surface, and lists go stale
Abusive sources rotate, scopes overlap, and a manual blocklist is out of date the moment you save it.
Threats reuse the same sources
Scanners, scrapers, and abusive networks hammer one domain, then move to the next behind the same ranges.
Static lists never expire
Hand-maintained allow and deny lists accumulate forever, with no record of why an entry is there or when it should go.
Scope conflicts are dangerous
A domain allow rule can quietly re-admit an address you banned platform-wide, opening a hole nobody intended.
What you get
Scoped IP controls with shared reputation
Set explicit rules where you need them, lean on cross-fleet reputation where you don't, and trust a clear resolution order in between.
Allow, deny, greylist
Express intent per range: always admit, always block, or challenge first. Greylisted clients must prove themselves before they pass.
Domain, account, platform scope
Apply a rule to one domain, an entire account, or the whole platform, with a clear precedence order across scopes.
TTLs on every entry
Give rules an expiry so temporary blocks clean themselves up. A reaper retires expired entries and keeps them for audit.
Non-overridable hard-deny
A platform hard-deny is checked before any allow. A tenant or domain rule cannot re-admit an address the platform has banned.
Cross-fleet reputation
Signals from across the fleet feed a shared reputation view, so an address abusing one site is known before it reaches yours.
Hashed IPs, private by design
Reputation keys on an HMAC hash of the client IP. Raw addresses never leave the edge, and matching stays local and in-memory.
How it works
From rule to enforcement
Author rules through the API or console, and the edge applies them in a fixed order on every request.
Set your rules
Add allow, deny, or greylist entries at the scope you need, each with a reason and an optional TTL.
Reputation fills the gaps
Where you have no explicit rule, cross-fleet reputation flags addresses with a recent history of abuse.
The edge enforces in order
Each request resolves hard-deny, then allow, deny, and greylist, then shared reputation, before any traffic reaches your origin.
FAQ
Questions, answered
- What is the difference between deny and greylist?
- Deny blocks the range outright. Greylist holds clients for a challenge first, so legitimate visitors can pass while automated clients are stopped.
- Can a domain rule override a platform ban?
- No. A platform hard-deny is evaluated before any allow rule, so no tenant, account, or domain entry can re-admit a banned address.
- Do my IP rules expire on their own?
- They can. Set a TTL on any entry and a reaper retires it on schedule, keeping the expired record available for audit.
- Do you store or share raw client IPs?
- No. Reputation keys on an HMAC hash of the IP. Raw addresses stay at the edge and are never sent to the control plane.
Take control of who reaches your origin
Set scoped IP rules with TTLs, back them with cross-fleet reputation, and enforce a platform ban nothing can override.