Security Rules¶

Each site has three categories of security rule: geographic blocks, bot blocks, and Web Application Firewall (WAF) rules with conditions. Enable the relevant site-level toggle (geo_blocking, bot_protection, waf) for rules to take effect — see Sites.

Geo blocks¶

Method	Path	Description
`GET`	`/sites/{site_id}/geo-blocks`	List geo rules
`POST`	`/sites/{site_id}/geo-blocks`	Create a rule
`PATCH`	`/sites/{site_id}/geo-blocks/{block_id}`	Update a rule
`DELETE`	`/sites/{site_id}/geo-blocks/{block_id}`	Delete a rule

curl -X POST https://api.skip2.net/v1/sites/1000/geo-blocks \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "United States", "action": "block"}'

curl -X PATCH https://api.skip2.net/v1/sites/1000/geo-blocks/1000 \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action": "javascript_challenge"}'

name is a full country name (not an ISO code, e.g. "United States" not "US") and action is block or javascript_challenge. PATCH only requires the fields you want to change — omitted fields keep their current value.

Bot blocks¶

Method	Path	Description
`GET`	`/sites/{site_id}/bot-blocks`	List bot rules
`POST`	`/sites/{site_id}/bot-blocks`	Create a rule
`PATCH`	`/sites/{site_id}/bot-blocks/{block_id}`	Update a rule
`DELETE`	`/sites/{site_id}/bot-blocks/{block_id}`	Delete a rule

curl -X POST https://api.skip2.net/v1/sites/1000/bot-blocks \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "GPTBot", "action": "block"}'

curl -X PATCH https://api.skip2.net/v1/sites/1000/bot-blocks/1000 \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action": "javascript_challenge"}'

action is block or javascript_challenge. PATCH only requires the fields you want to change.

WAF rules¶

A WAF rule (block) groups one or more conditions. A request is matched when the conditions evaluate true according to their AND/OR conjunctions.

Method	Path	Description
`GET`	`/sites/{site_id}/waf-blocks`	List rules + conditions
`POST`	`/sites/{site_id}/waf-blocks`	Create a rule
`PATCH`	`/sites/{site_id}/waf-blocks/{id}`	Update a rule
`DELETE`	`/sites/{site_id}/waf-blocks/{id}`	Delete a rule
`GET`	`/sites/{site_id}/waf-blocks/{id}/conditionals`	List conditions
`POST`	`/sites/{site_id}/waf-blocks/{id}/conditionals`	Add a condition
`DELETE`	`/sites/{site_id}/waf-blocks/{id}/conditionals/{cid}`	Delete a condition

Create a rule, then add conditions:

curl -X POST https://api.skip2.net/v1/sites/1000/waf-blocks \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Block admin scans", "action": "block"}'

curl -X POST https://api.skip2.net/v1/sites/1000/waf-blocks/1000/conditionals \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "uri contains wp-admin",
        "conjunction": "and",
        "request_attribute": "uri",
        "comparison": "contains",
        "match": "/wp-admin",
        "order": 1
      }'

Update a rule’s action (only supplied fields change):

curl -X PATCH https://api.skip2.net/v1/sites/1000/waf-blocks/1000 \
  -H "Authorization: Bearer $SKIP2_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action": "log"}'

Condition fields:

conjunction — and or or (lowercase).
request_attribute — uri, header, method, query or body.
comparison — equals, contains, starts_with, ends_with or regex.
match — the value to compare against.
order — evaluation order (integer).
action (on the rule) — block, allow, challenge or log.