Policy
Choose a protection level, set the low-trust and block lines, and turn individual signals on or off — all on one tab.
Overview
Policy is the fourth tab of the Security page, reached from Audience → Security. It controls how Security behaves: whether it runs at all, where it draws the low-trust and block lines, and which signals it watches. It replaces the old separate Rules and Settings pages — everything now lives here. (The old /rules and /settings links redirect here automatically.)
Security monitoring
A master switch at the top, Score every visitor in real time, turns the whole engine on or off:
- On — every visitor is scored in real time and can be flagged or auto-blocked
- Off — no signals are evaluated and no visitor is scored or blocked. The rest of the tab dims to show monitoring is paused.
Protection level
Three one-click presets set both lines at once. Pick the one that matches your risk tolerance, or drag the lines yourself — the label then reads Custom.
| Preset | Block line | Low-trust line | Best for |
|---|---|---|---|
| Relaxed | 20 | 30 | Only flags as low trust when several signals stack; still bans outright attacks |
| Balanced (recommended) | 26 | 40 | One weak signal never flags; bans bots and attacks |
| Strict | 30 | 46 | Any single signal is flagged as low trust; also bans stacks of signals |
Balanced is the default. Its numbers are tuned so that a normal anonymous visitor (who starts at 50) is never flagged by one stray signal, while bots and attack tools are blocked for sure.
The low-trust and block lines
Below the presets, the Trust thresholds section shows a single 0–100 bar with two draggable handles:
- Block line (red) — visitors scoring below it are automatically blocked from chat
- Low-trust line (yellow) — visitors between the two lines are flagged as low trust; at or above it they're trusted
The controls won't let the block line rise above the low-trust line. A live legend under the bar follows the handles as you drag, so you can see what each band will mean. Below that, an impact strip counts how many of your current visitors sit in each zone — those counts are calculated at your saved lines, and while you have unsaved changes the strip says so.
Signals
Below the lines is the catalog of built-in signals, grouped as Risk · Bot detection, Risk · Behavioral, Risk · Network and Trust. Each signal has a single on/off toggle — that's the only control. Its impact is fixed and shown as a read-only number (how many points it moves the trust score), with a Permanent or Expires 30d tag next to the name. You can't change a signal's weight by hand, and you can't write your own detection rules — the catalog is the same well-tuned set for everyone.
Risk signals (lower the score)
| Signal | Group | What it detects | Impact | Default |
|---|---|---|---|---|
| Attack-tool user-agent | Bot detection | The browser identifies itself as a known attack or scanner tool (sqlmap, nikto, nmap, masscan, zgrab). | −50, permanent — a single hit blocks | On |
| High event velocity | Bot detection | Sustained machine-paced activity in a recent window — many distinct page loads and interactions packed into single minutes. Repeated views of one URL don't count, so heavy human browsing stays under the bar. A lone hit only flags as low trust; it needs a second risk signal to block. | −20, expires after 30 days | On |
| Disposable email address | Behavioral | The email uses a known throwaway domain. Privacy relays like iCloud Hide My Email are not flagged. | −8, expires after 30 days | On |
| No-reply / automated email | Behavioral | The email is a no-reply, bounce, mailer-daemon or similar non-human mailbox. Ordinary shared mailboxes (info@, support@) are never flagged. | −5, expires after 30 days | On |
| Suspicious URL accessed | Network | The visitor loaded a page whose path matches a secret- or source-exposure pattern: /.env, /.git/, /.svn/, cmd.exe, shell.php and well-known system-file paths. | −50, permanent — a single hit blocks | On |
/wp-admin are deliberately left out — a legitimate site operator browsing their own admin area must never be blocked for it.Trust signals (raise the score)
Trust signals never decay; every one of them is tagged Permanent.
| Signal | What it credits | Impact | Default |
|---|---|---|---|
| Established visitor (30 days) | The visitor's record is between 30 and 90 days old | +5 | On |
| Long-standing visitor (90 days) | The record is older than 90 days | +10 | On |
| Returning visitor (multiple days) | They have come back on 3 or more separate days | +10 | On |
| Wrote a message | They have sent at least one genuine message — in chat, email, social or voice | +15 | On |
| Email address set | The visitor has an email on file — the primary "contactable person" signal | +15 | On |
| External account ID set | Linked to your own backend via the SDK identify() call | +10 | Off |
| Customer value set | A positive customer value / LTV is set via the SDK | +10 | Off |
| Plan set | A plan / subscription value is set — presence only, any value including "free" | +5 | Off |
| Display name set | The visitor has a display name | +5 | Off |
Saving changes
Any edit raises a sticky bar at the bottom showing how many changes are unsaved. Click Save changes to apply or Reset to discard. Saving is blocked while the block line isn't below the low-trust line. Changes apply going forward — existing scores aren't recalculated retroactively.
Tuning tips
- Global audience? The signals no longer penalise night-time activity, shared IP addresses, many countries or many devices, and they no longer run VPN/Tor reputation checks — those turned out to be almost always wrong on long-lived mobile connections. Travellers and remote teams shouldn't pile into the low-trust band. If they still do, move to the Relaxed preset.
- Lots of identified users? Leave the trust signals on so your real customers float to the top of the score range.
- Seeing too many or too few flags? Adjust the preset or drag the low-trust line rather than touching individual signals — the lines are the simplest lever.