Go to Traffic Guard > Settings. Super Users and Admins can change these.
| Setting | Default | Effect |
|---|---|---|
| Check requests | On | Off: every request is let through and nothing is logged. |
| Protection mode | Normal | Normal, Elevated or Under attack. Each mode has its own limits, scores and signal weights. See Protection Modes. |
| Ban automatically | On | An address whose request is blocked is banned. |
| Ban length (hours) | 1 | How long an automatic ban lasts. |
| Always allow private networks | On | Addresses on private networks (10.x.x.x, 172.16–31.x.x, 192.168.x.x, 127.0.0.1, ::1 and other reserved ranges) are never counted, limited or logged. |
| Behind a proxy | Off | Read the visitor's address from the first entry of X-Forwarded-For. See Installation. |
| Log allowed requests | Off | Log every request, not only those slowed down or blocked. Useful for a short while to tune limits. |
| Keep events (days) | 30 | Older events are deleted over time. 0 keeps them all. |
| Events per page | 50 | On the dashboard. |
Rate limits
How many requests one address may make in a minute, for each kind of page and each mode:
| Pages | Normal | Elevated | Under attack |
|---|---|---|---|
| All other pages | 120 | 80 | 40 |
| Searches (the search page, the advanced search form, and keyword or field searches of browse pages) | 20 | 10 | 5 |
| Record pages (items, collections, files and exhibits) | 80 | 50 | 25 |
REST API (/api/…) |
60 | 40 | 20 |
MCP Server (/mcp… and the OAuth discovery documents) |
240 | 120 | 60 |
Going over 80 percent of a limit, and over the limit, raise the address's risk score. A limit alone does not block a normal browser in Normal mode; together with other signals it does. See Risk Scoring.
Risk scores
A request scoring at least the "Slow down" score gets a 429 with Retry-After: 60; at least the "Block" score, a 403 and, with automatic bans on, a ban.
| Normal | Elevated | Under attack | |
|---|---|---|---|
| Slow down | 40 | 30 | 20 |
| Block | 70 | 55 | 40 |