Security & access
Configure request protections and administrative access for your deployment.
Protect each domain
The request path supports WAF rules, IP access controls, rate limiting and bandwidth caps. Configure these for the traffic you expect. Request-level WAF and connection-level auto-block address different layers of traffic.
domains:
- host: example.com
type: static
root: /var/www/html
security:
rate_limit:
requests: 100
window: 1m
Administrative access
UWAS includes admin, reseller and user roles, TOTP two-factor authentication and audit logging. The admin API and MCP listeners should stay private. Use the current hashed-credential workflow; legacy plaintext API-key fallback is opt-in.
Auto-block and the firewall
Connection-level thresholds can identify aborted handshakes and excessive connections. Canonical-host redirects now count toward domain rate limits, and global rate-limit rejections feed auto-block when feed_rate_hits is enabled. Observe dry-run behavior and review max_rate_hits for shared NAT clients before enforcing thresholds. Behind a proxy, configure trusted proxies and allowlists carefully.
Report a vulnerability
Use the repository’s Security tab and security policy for disclosure guidance. Read UPGRADING.md for changes to authentication and multi-user defaults. Validate the server against your own deployment and security requirements.