Plexivo Shield

Every public Plexivo App Runner app is protected at the edge by Plexivo Shield, with rate limits, request size limits and IP allow and deny lists you control.

Plexivo Shield protects every public app you deploy, on every plan, from the moment it is created. Requests are checked at the Plexivo edge, before they reach your app.

What it does#

Protection	What happens	Default
DDoS protection	Floods are absorbed at the edge before they reach your app.	Always on
TLS	Certificates are issued and renewed for every hostname.	Always on
Rate limit	Requests above the app’s limit are answered with `429`.	100 a second, bursts of 200
Request size limit	Larger requests are refused with `413`.	10 MB
IP allow and deny lists	Admit only listed networks, or refuse listed ones first.	Empty: everyone admitted

The rate limit is shared by all of the app’s visitors, not set for each visitor. It is applied where traffic enters Plexivo, so treat it as a guard against floods rather than an exact quota. IP rules match the visitor’s real address, so a forged X-Forwarded-For header changes nothing.

Set an app’s protection#

Open Networking → Shield and choose the app.
Rate limit. Set Requests per second (1 to 10,000) and Burst (at least the rate, up to 100,000). Set it well above your busiest traffic.
Request size. Set the Largest request body (MB), from 1 to 100.
IP rules. Under Allow only these and Always deny, enter one address or CIDR range per line, up to 100 each. IPv4 and IPv6 both work.
Save. Review and choose Save policy. Plexivo sends it to the edge straight away.

During an attack, add the offending ranges to Always deny.

bash

curl -s -X PUT $API/deployments/$APP/shield \
  -H "Authorization: Bearer $PLEXIVO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rate_limit": {"requests_per_second": 500, "burst": 1000}, "max_body_mb": 25, "ip_deny": ["198.51.100.0/24"]}'

See what was blocked#

Networking → Shield shows how many requests were blocked in the last 24 hours, and each app’s Recent events: when, from where, on which path and by which rule.

For businesses Before a launch or a sale, raise the rate limit to well above the traffic you expect. A limit set too low turns a good day into 429 errors.

Next steps#

Public and private appsNo public address at all for internal services. Custom domainsShield protects them with the app’s policy.

Updated 27 October 2026