Configure Response Page of Deny Action
Last update：2026-08-21 14:25:59
Configure Response Page of Deny Action
Reading time: About 5 minutes
Prerequisites: None
Navigation path: Security Settings > Policies > [Target Hostname] > General Settings > Response Page of Deny Action
Overview
When a request is blocked by a security policy (such as WAF, Rate Limiting, IP/Geo Firewall, etc.), the platform returns a default block page. By configuring the Response Page of Deny Action, you can customize the default block page content to align with your brand image or provide more helpful information to end users.
Difference from Custom Response Actions:
- Response Page of Deny Action (this feature): Sets a global default block page for all rules that use the Deny action
- Custom Response Actions: Configures custom response content for specific rules (e.g., Rate Limiting, Workflow Detection), with higher priority than the global default page
Configuration Steps
- Go to Security Settings > Policies, select the target hostname to enter the editing page
- Select the General Settings tab
- Locate the Response Page of Deny Action configuration area
- Configure the following fields:
| Configuration Item | Description |
|---|---|
| Response Status Code | The HTTP status code returned to the client; defaults to 403 |
| Content-Type | The response content type, e.g., text/html |
| Response Body | Custom page content in HTML format (max 16 KB) |
- Click Deploy at the bottom to apply the configuration
Available Variables in the Response Body
The following variables can be referenced in the HTML response body. Their actual values are recorded in the attack logs, making it easier for users to locate the block event when providing feedback:
| Variable | Description | Sample Output |
|---|---|---|
{url} |
The full URL of the blocked request | https://example.com/login |
{client_ip} |
The client IP of the blocked user | 1.2.3.4 |
{time} |
The time when the block occurred | 2025-01-01 12:00:00 |
{event_id} |
The unique ID of the block event | b9c8775c... |
Configuration Example
A user-friendly notice page for end users:
<!DOCTYPE html>
<html>
<head><title>Access Restricted</title></head>
<body>
<h1>Your request has been blocked by the security policy</h1>
<p>If you believe this is a false positive, please contact us with the following information:</p>
<ul>
<li>Event ID: {event_id}</li>
<li>Your IP: {client_ip}</li>
<li>Time: {time}</li>
</ul>
<p>Email: support@example.com</p>
</body>
</html>
Tip: When referencing static resources such as images in the response body, use absolute URLs to avoid loading failures caused by relative paths in block scenarios.