Security

Settings → Security writes rules into /etc/nginx/xaxa/sites/<domain>/security.conf, which every vhost includes. Changes are tested with nginx -t before nginx reloads.

Block IPs

One IPv4/IPv6 address or CIDR range per line. Blocked clients get 403 Forbidden.

203.0.113.7
198.51.100.0/24
2001:db8::/32

Block bots

User-agent fragments, one per line, matched case-insensitively. Useful against aggressive crawlers:

AhrefsBot
SemrushBot
MJ12bot

Basic authentication

Protect the whole site with a username and password — handy for staging sites. Passwords are hashed with SHA-512 crypt; the panel never stores them. Let's Encrypt validation keeps working while basic auth is on. Leave the password empty to keep the current one; changing the username needs a new password.

Cloudflare only

Allows requests only from Cloudflare's IP ranges, so visitors cannot bypass Cloudflare by hitting your server's IP directly. Enable it only when the DNS record is proxied (orange cloud). The ranges are refreshed from Cloudflare every Monday; a list that looks incomplete or that nginx rejects is not applied.

Visitor addresses behind Cloudflare

Behind the orange cloud every connection comes from Cloudflare. For connections from Cloudflare's ranges (and only those, so nobody else can fake it) nginx takes the visitor's address from the CF-Connecting-IP header. Site logs, traffic statistics, Block IPs, PHP's REMOTE_ADDR, the X-Forwarded-For / X-Real-IP headers of Node.js and Python apps, and the panel's own sign-in limits all see the visitor, not Cloudflare. Nothing needs to be turned on.