bunny.net Shield — rule builder & tester

Mirrors the dashboard's Request Matching form for Custom WAF and Rate Limit rules, then runs it against a simulated request: URL, headers, cookies, args, body, geo and more. · Rule Engine · Custom WAF rule · Rate limit rule · Edge Rules use Lua instead: Lua tool

Examples

Request Matching

Variable

Operator

Variable Value

Operator Value

Build a regex from plain text

Escapes regex characters and writes the result into Operator Value.

Transformations — applied in this order, before the operator

Response Action

Test request

URL

Method

Protocol

Cookie header — parsed into REQUEST_COOKIES, one entry per cookie

Other headers — one Name: value per line

Body, client, geo, TLS, response

Request body — form-encoded bodies become ARGS_POST

Upload field names (FILES_NAMES, comma-sep.)

Client IP

GEO COUNTRY_CODE

GEO CONTINENT

GEO CITY

GEO ASN

GEO ORGANIZATION

GEO LATITUDE / LONGITUDE

FINGERPRINT (JA4)

VERIFIED_BOT_CATEGORY

RESPONSE_STATUS

Response headers

Response body

How matching works

Variable Value narrows a collection to one key, for example a cookie name or a header name. Leave it empty and every entry is tested, so any cookie or header can trigger the rule.
Collections are tested one value at a time, and the rule triggers if any value matches. A cookie's value is just its value: with Variable Value _savespace, the ph_savespace cookie is never looked at.
To test whether a cookie exists, use REQUEST_COOKIES_NAMES with STREQ and the cookie's name.
Cookie values are not URL-decoded. Add URLDECODE to match %7B… as {….
Transformations run first, in order. After LOWERCASE, an Operator Value with capital letters can only match with case-insensitive operators (STREQ).
RX is a .NET-style regular expression, tested here with JavaScript's engine. Escape with \, not Lua's %, and use | for alternatives. An unanchored regex matches anywhere in the value.
REQUEST_URI is processed, with percent-encoding decoded. REQUEST_URI_RAW keeps the encoding. Neither contains the host.
DETECTSQLI and DETECTXSS use Shield's own detection, so this page can't simulate them.

bunny.net Shield — rule builder & tester

Request Matching

Response Action

Rate exceeding & Response action

Test request