# Security **URL:** https://community.fastly.com/c/security/7.md [Latest](https://community.fastly.com/latest.md) · [Categories](https://community.fastly.com/categories.md) · [Tags](https://community.fastly.com/tags.md) --- ## [About the Security category](https://community.fastly.com/t/about-the-security-category/26)
**Author:** [@journie.johnson](https://community.fastly.com/u/journie.johnson)\ **Replies:** 3\ **Last updated:** [July 16, 2023, 11:46am UTC](https://community.fastly.com/t/about-the-security-category/26 "2023-07-16T11:46:51Z")
For discussion of security related topics. --- ## [Client challenges: can Fastly adhere to \`prefers-color-scheme: dark\`?](https://community.fastly.com/t/client-challenges-can-fastly-adhere-to-prefers-color-scheme-dark/4488)
**Author:** [@beedell.roke](https://community.fastly.com/u/beedell.roke)\ **Replies:** 3\ **Last updated:** [September 9, 2026, 9:17pm UTC](https://community.fastly.com/t/client-challenges-can-fastly-adhere-to-prefers-color-scheme-dark/4488 "2026-09-09T21:17:34Z")
Currently, Fastly does not appear to adhere to color-scheme: light dark, because when my prefers-color-scheme is dark, the undermentioned reproduces: --- ## [NGWAF Caddy plugin](https://community.fastly.com/t/ngwaf-caddy-plugin/4490)
**Author:** [@stepbrobd](https://community.fastly.com/u/stepbrobd)\ **Replies:** 0\ **Last updated:** [September 6, 2026, 4:15pm UTC](https://community.fastly.com/t/ngwaf-caddy-plugin/4490 "2026-09-06T16:15:07Z")
Since NGWAF don’t have an official Caddy (GitHub - caddyserver/caddy: Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS · GitHub) plugin (well, Caddy isn’t like nginx or HAproxy, I believe its… --- ## [Introducing API Enforcement](https://community.fastly.com/t/introducing-api-enforcement/4472)
**Author:** [@lorrainebellon](https://community.fastly.com/u/lorrainebellon)\ **Replies:** 0\ **Last updated:** [August 25, 2026, 9:26pm UTC](https://community.fastly.com/t/introducing-api-enforcement/4472 "2026-08-25T21:26:18Z")
:rocket: API Enforcement We’re excited to announce API Enforcement is generally available. API Enforcement uses your OpenAPI schemas to validate and control API traffic at the edge and prevent unacceptable requests from… --- ## [How to block IPSec/VPN](https://community.fastly.com/t/how-to-block-ipsec-vpn/3960)
**Author:** [@chris.harper](https://community.fastly.com/u/chris.harper)\ **Replies:** 4\ **Last updated:** [March 16, 2026, 12:10pm UTC](https://community.fastly.com/t/how-to-block-ipsec-vpn/3960 "2026-03-16T12:10:27Z")
Hi Guys, We use geofencing to limit the surface of bad actors but naturally they can terminate VPN tunnels within the UK. Is there a way to prevent VPN tunnels as I know Fastly can identify ToR browsers from fingerprint… --- ## [API Discovery just got better: introducing Inventory](https://community.fastly.com/t/api-discovery-just-got-better-introducing-inventory/4314)
**Author:** [@lorrainebellon](https://community.fastly.com/u/lorrainebellon)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 2:13pm UTC](https://community.fastly.com/t/api-discovery-just-got-better-introducing-inventory/4314 "2026-02-03T14:13:10Z")
:rocket: Fastly API Discovery Just Got Even Better :chart\_increasing: Fastly API Discovery gives you one-click access to discover, monitor, and secure your APIs easily. It continuously monitors your API traffic within F… --- ## [\_acme-challenge conflicting records](https://community.fastly.com/t/acme-challenge-conflicting-records/2238)
**Author:** [@sdarwin](https://community.fastly.com/u/sdarwin)\ **Replies:** 15\ **Last updated:** [October 30, 2025, 6:28pm UTC](https://community.fastly.com/t/acme-challenge-conflicting-records/2238 "2025-10-30T18:28:29Z")
Hi, We would like to add the Fastly CDN in front of a website hosted on GCP Google Cloud Platform. It seems that the most compatible configuration (in certain ways) is to have the same hostname on the backend and fronte… --- ## [\[Launches\] Fastly API Discovery](https://community.fastly.com/t/launches-fastly-api-discovery/4244)
**Author:** [@lorrainebellon](https://community.fastly.com/u/lorrainebellon)\ **Replies:** 0\ **Last updated:** [September 30, 2025, 4:19pm UTC](https://community.fastly.com/t/launches-fastly-api-discovery/4244 "2025-09-30T16:19:26Z")
:rocket: Fastly API Discovery Is Here: Gain Full API Visibility and Control We’re excited to launch Fastly API Discovery, built to help you discover, monitor, and secure your APIs with ease. By continuously monitoring … --- ## [Empty string for the "updated\_at" field of the ngwaf signals endpoint response](https://community.fastly.com/t/empty-string-for-the-updated-at-field-of-the-ngwaf-signals-endpoint-response/4243)
**Author:** [@Tom-2013-06417](https://community.fastly.com/u/Tom-2013-06417)\ **Replies:** 2\ **Last updated:** [September 30, 2025, 2:15pm UTC](https://community.fastly.com/t/empty-string-for-the-updated-at-field-of-the-ngwaf-signals-endpoint-response/4243 "2025-09-30T14:15:43Z")
Hi, Not sure if this is just me, or if this has been posted around somewhere (I can’t seem to search other posts about this), but I was trying to make a GET request with the ngwaf workspace signals API: curl -s -H "Fas… --- ## [Shared domain across accounts?](https://community.fastly.com/t/shared-domain-across-accounts/4197)
**Author:** [@shoelessone](https://community.fastly.com/u/shoelessone)\ **Replies:** 1\ **Last updated:** [August 13, 2025, 2:29pm UTC](https://community.fastly.com/t/shared-domain-across-accounts/4197 "2025-08-13T14:29:31Z")
My organization has multiple Fastly accounts, which we use to isolate different services from different types of users (e.g. internal services vs customer facing production services, etc). We would like to create a new … --- ## [Flip the script on attackers with our new Next-Gen WAF Deception action!](https://community.fastly.com/t/flip-the-script-on-attackers-with-our-new-next-gen-waf-deception-action/4184)
**Author:** [@lorrainebellon](https://community.fastly.com/u/lorrainebellon)\ **Replies:** 0\ **Last updated:** [August 7, 2025, 3:24pm UTC](https://community.fastly.com/t/flip-the-script-on-attackers-with-our-new-next-gen-waf-deception-action/4184 "2025-08-07T15:24:38Z")
Exciting news! Fastly has just launched a powerful new capability for our Next-Gen WAF called the Deception action. Instead of just blocking attackers, you can now actively deceive them, turning your defenses from a simp… --- ## [Are HTTP/1.0 requests auto-upgraded to HTTP/1.1?](https://community.fastly.com/t/are-http-1-0-requests-auto-upgraded-to-http-1-1/3849)
**Author:** [@JamoCA](https://community.fastly.com/u/JamoCA)\ **Replies:** 4\ **Last updated:** [February 1, 2025, 12:08am UTC](https://community.fastly.com/t/are-http-1-0-requests-auto-upgraded-to-http-1-1/3849 "2025-02-01T00:08:52Z")
When logging requests to our servers using StackPath or Edgio (or even directly against the origin), we could check the IIS CGI.SERVER\_PROTOCOL variable. We discovered that many, many spammers blindly use “HTTP/1.0” and… --- ## [Blocking Empty Form Posts](https://community.fastly.com/t/blocking-empty-form-posts/3771)
**Author:** [@JamoCA](https://community.fastly.com/u/JamoCA)\ **Replies:** 4\ **Last updated:** [January 6, 2025, 10:26pm UTC](https://community.fastly.com/t/blocking-empty-form-posts/3771 "2025-01-06T22:26:01Z")
Since migrating our web applications to Fastly, I’ve noticed a large uptick in the number of empty form posts from non-consumer, non-US IP addresses. Could a site-based “Templated Rule” to “Block Empty Form Posts” be ad… --- ## [Fastly Malicious hits](https://community.fastly.com/t/fastly-malicious-hits/3691)
**Author:** [@Sai](https://community.fastly.com/u/Sai)\ **Replies:** 1\ **Last updated:** [November 11, 2024, 5:57pm UTC](https://community.fastly.com/t/fastly-malicious-hits/3691 "2024-11-11T17:57:47Z")
we have a particular UA and would hit us 300M times in 3 days Actually from Amazon Datacenter. The user agent is :Microsoft Office/16.0 (Windows NT 10.0; Microsoft Outlook 16.0.4849; Pro) As why would outlook come fro… --- ## [List Alerts API pagination and filter params](https://community.fastly.com/t/list-alerts-api-pagination-and-filter-params/2735)
**Author:** [@sagarsim](https://community.fastly.com/u/sagarsim)\ **Replies:** 2\ **Last updated:** [June 25, 2024, 4:40am UTC](https://community.fastly.com/t/list-alerts-api-pagination-and-filter-params/2735 "2024-06-25T04:40:14Z")
I am trying to integrate Fastly List Alerts API . There is no info. about pagination or filter params in the API documentation. Will the API return all the alerts every time? What is the max no. of alerts that will be … --- ## [Web Workflow Validation and Enforcement Using ERL Penalty Box](https://community.fastly.com/t/web-workflow-validation-and-enforcement-using-erl-penalty-box/2537)
**Author:** [@BrooksCunningham](https://community.fastly.com/u/BrooksCunningham)\ **Replies:** 0\ **Last updated:** [February 27, 2024, 2:08pm UTC](https://community.fastly.com/t/web-workflow-validation-and-enforcement-using-erl-penalty-box/2537 "2024-02-27T14:08:04Z")
Fastly’s Edge Rate Limiting Product is great for protecting against attacks such as DDOS. Since ERL does maintain a limited amount of state, there are other creative things you can do with ERL. In this example, I’ll e… --- ## [Edge Rate Limiting Request enrichment to Next-Gen WAF](https://community.fastly.com/t/edge-rate-limiting-request-enrichment-to-next-gen-waf/430)
**Author:** [@BrooksCunningham](https://community.fastly.com/u/BrooksCunningham)\ **Replies:** 0\ **Last updated:** [September 12, 2023, 12:36pm UTC](https://community.fastly.com/t/edge-rate-limiting-request-enrichment-to-next-gen-waf/430 "2023-09-12T12:36:34Z")
Our Next-Gen WAF customers are often looking for more functionality and visibility when it comes to inspecting their web application traffic. Fastly’s Edge Rate Limiting product has the ability to very quickly detect and… --- ## [List VCL services linked with Next-Gen WAF (NGWAF) Edge Deployment using Terraform](https://community.fastly.com/t/list-vcl-services-linked-with-next-gen-waf-ngwaf-edge-deployment-using-terraform/2533)
**Author:** [@BrooksCunningham](https://community.fastly.com/u/BrooksCunningham)\ **Replies:** 0\ **Last updated:** [February 23, 2024, 2:29pm UTC](https://community.fastly.com/t/list-vcl-services-linked-with-next-gen-waf-ngwaf-edge-deployment-using-terraform/2533 "2024-02-23T14:29:00Z")
If you are looking of the list of VCL services that are linked to a Fastly Next-Gen WAF edge deployment, then you may call on the API endpoint described in our online documentation, Edge deployment. You may also use Ter… --- ## [Include request ID in a synthetic response](https://community.fastly.com/t/include-request-id-in-a-synthetic-response/2468)
**Author:** [@BrooksCunningham](https://community.fastly.com/u/BrooksCunningham)\ **Replies:** 0\ **Last updated:** [February 7, 2024, 8:45pm UTC](https://community.fastly.com/t/include-request-id-in-a-synthetic-response/2468 "2024-02-07T20:45:54Z")
Hey Folks, Presenting an end user with an identifier when they encounter an issue on a web page can significantly enhance the troubleshooting process and improve the user experience for several reasons: Improved Suppo… --- ## [Terraforming NGWAF Edge Deployment with Existing VCL Services](https://community.fastly.com/t/terraforming-ngwaf-edge-deployment-with-existing-vcl-services/454)
**Author:** [@BrooksCunningham](https://community.fastly.com/u/BrooksCunningham)\ **Replies:** 0\ **Last updated:** [September 28, 2023, 6:57pm UTC](https://community.fastly.com/t/terraforming-ngwaf-edge-deployment-with-existing-vcl-services/454 "2023-09-28T18:57:36Z")
Deploying Next-Gen WAF onto an existing VCL Service This post will go over how incorporating your Next-Gen WAF Edge deployment can work with your existing Fastly VCL service. Setting the stage We are going to have a ver… --- ## [Collecting Counts of Requests without Sampling](https://community.fastly.com/t/collecting-counts-of-requests-without-sampling/449)
**Author:** [@BrooksCunningham](https://community.fastly.com/u/BrooksCunningham)\ **Replies:** 0\ **Last updated:** [September 25, 2023, 1:42pm UTC](https://community.fastly.com/t/collecting-counts-of-requests-without-sampling/449 "2023-09-25T13:42:37Z")
Problem Overview Accountants are busy and our customers need a way to count the number of requests utilized by different departments for internal billing and cost sharing. The requests that are associated with the differ… --- ## [Developer accounts now get 2 custom domains free! 🆓](https://community.fastly.com/t/developer-accounts-now-get-2-custom-domains-free/81)
**Author:** [@jenn](https://community.fastly.com/u/jenn)\ **Replies:** 0\ **Last updated:** [April 6, 2023, 4:17pm UTC](https://community.fastly.com/t/developer-accounts-now-get-2-custom-domains-free/81 "2023-04-06T16:17:51Z")
I’ve personally been waiting for this before really diving into Fastly’s offerings since the Glitch team joined: free Fastly developer accounts now come with 2 free managed TLS certificates for your own domains. I recen…