Shields

Shields are block rules checked as events arrive. A blocked event is accepted by the endpoint (it returns 202) but is not stored, so attackers learn nothing and your script never errors.

Open Site settings → Shields.

Type	Example	Behavior
IP address	203.0.113.7, 203.0.113.0/24 or 203.0.113.*	Drops events from matching IPs
Country	DE	Drops events from that two-letter country code
Page	/admin/*	Drops pageviews and events for matching paths
Hostname	example.com	Counts only the listed hostnames

Hostname allow-list

A hostname shield is an allow-list. Once you add one, events from any other hostname are dropped. This stops people from copying your snippet onto another domain and polluting your stats. Wildcards work, so *.example.com allows subdomains.

Server-wide rules

Two options in .env apply to every site: TIDEMARK_IGNORE_IP and TIDEMARK_HOSTNAMES.

Note

IP addresses used in shield rules are matched in memory when the event arrives. They are not stored with the event.