Emergency modes

Under attack and lockdown: what they actually do, and why you must switch them back off.

3 minUpdated Aug 16, 2026

Two switches under Tools → Protection, set per site. They are built for an ongoing attack, not for permanent use.

Under-attack mode

Applies an aggressive per-address rate limit. A normal visitor notices nothing; a machine sending hundreds of requests a minute is slowed then refused. It is the first reflex against an abnormal spike.

Emergency lockdown

Your site becomes unreachable

Every visitor gets a 503 error, except addresses on your allow list. Your payment providers' notifications are refused too. It is a panic button: it stops the bleeding, it fixes nothing.

While it is on, a red banner shows on every dashboard page for every role — including people who did not switch it on and who would otherwise read a traffic chart believing they are looking at served visits. After an hour the account owner gets an email alert.

Lockdown never lifts by itself. Automatically switching off a protection during an attack would be worse than the problem it addresses — so switching it back is up to you.

Scope

Both modes are per site: one client's panic button does not take down the other sites on your account. The Firewall switch on the same page, however, applies to the whole organisation — the card says so.