Shields
Shields are block rules checked as events arrive. A blocked event is accepted by the endpoint (it returns 202 ) but is not stored, so attackers learn nothing and your script never errors.
Open Site settings → Shields.
| Type | Example | Behavior |
|---|---|---|
| IP address | 203.0.113.7, 203.0.113.0/24 or 203.0.113.* |
Drops events from matching IPs |
| Country | DE |
Drops events from that two-letter country code |
| Page | /admin/* |
Drops pageviews and events for matching paths |
| Hostname | example.com |
Counts only the listed hostnames |
Hostname allow-list
A hostname shield is an allow-list. Once you add one, events from any other hostname are dropped. This stops people from copying your snippet onto another domain and polluting your stats. Wildcards work, so *.example.com allows subdomains.
Server-wide rules
Two options in .env apply to every site: TIDEMARK_IGNORE_IP and TIDEMARK_HOSTNAMES .
Note:
IP addresses used in shield rules are matched in memory when the event arrives. They are not stored with the event.