All postsLast week Atlas Shield started guarding your forms. Today it guards the whole site. Every request that reaches an Atlas brand site now passes Shield before anything is rendered: probes are turned away, attacks are refused, floods are slowed down, and you can see all of it in a new Shield dashboard in Atlas.
What actually knocks on your door
Before writing a single rule we read the access logs of our own sites. Within days of going live, atlascms.id was being asked for /.env, /.env.production, /.git/config, /.aws/credentials, /.npmrc, /service-account.json and /wp-admin/install.php, plus webshell hunts like //images/images/images/cache.php that walk one folder deeper on every try. None of these files exist on an Atlas site. The bots do not know that, and they keep coming.
Shield now recognises these families and refuses them before your site spends any work on them:
- Secret and source file hunts: dotfiles, cloud credentials, database dumps, backups and config files.
- CMS and webshell probes: WordPress doors, phpMyAdmin, server consoles and script files an Atlas site never serves.
- Path traversal:
../in every encoding we have seen, including double encoded and null byte tricks. - Injection: SQL injection, cross site scripting, template injection and the Log4Shell and Shellshock patterns.
- Attack tools: sqlmap, Nikto, Nuclei, WPScan and friends are refused by name.
Search engines and AI crawlers are never refused, /.well-known/ stays open, and if one of your old URLs still has a redirect, the redirect wins. We test every rule against real visitor requests too, so a reader searching your blog for "javascript tips" is not mistaken for an attack.
Four levels, your choice
- Off records what would be blocked and blocks nothing. Good for a first look.
- Standard blocks probes, attack patterns, attack tools and any visitor over the request budget. This is the default.
- High halves the budget and also turns away empty user agents, bare HTTP libraries and internet wide scanners.
- Under attack sends every new visitor through a short browser check first. A real browser solves it in a fraction of a second and carries on for twelve hours; a bot flood stops at the door.
You do not have to watch the graphs at night. When a site refuses 500 requests in five minutes, Shield switches to under attack on its own for an hour, tells your publishers and admins, and steps back down when the hour is over. You can end it early with one click.
A dashboard with an access log
The new Shield page shows what reaches your site over the last 24 hours, 7 days or 30 days: traffic and threats on two charts, why requests were refused, the busiest addresses, countries and paths, all updating live. Under it sits the access log. Every warning and critical request is kept, together with a sample of normal traffic, and you can filter by level, action, rule, address or path. Open any row to see the full request, then block or always allow that address in one click. Address rules can be a single address or a range and can expire on their own.
Every event has a level. Info is normal or low risk traffic, warning is a refused probe or a visitor over the budget, and critical is path traversal, a dangerous injection or an address that keeps attacking. Critical events send a notification, at most one every fifteen minutes, so a bad night does not turn into a hundred alerts.
Built with privacy in mind
The access log holds visitor addresses, so only publishers and admins can see it, the same people who can see your leads. Events are deleted after 30 days, notifications and live updates carry counts only, and the address rules never leave your site's server.
Not a replacement for your CDN
Keep Cloudflare, Bunny or whatever sits in front of your site. Shield is the layer that knows your site: its redirects, its brand, its team and its content. The two work best together.
Do I need to do anything?
No. Sites on the latest Atlas layer run Shield at the Standard level automatically. To pick another level, open Shield in the Atlas admin. If your site sits behind a proxy, make sure it forwards the visitor address (NUXT_ATLAS_TRUST_PROXY) so the request budget counts real visitors. The details are in the docs.
