# How do I turn on a rate-limit or blocking rule without blocking real users?

Because a new blocking rule that is **tuned wrong will block real users**: a rate limit set too tight, a scanner filter that also matches a legitimate crawler, a velocity rule that trips on a busy real customer. Ship it straight to enforce and you risk a **self-inflicted outage that looks exactly like an attack.** This is the practical form of a simple principle: if you put a rule in place, you need to know what it will catch *and* what it will release, before it is live.

**Run every new blocking, velocity or rate rule in observe-only mode first.** It is testing the smoke alarm before you wire it to the sprinklers:

```
# Stage 1 (observe): log what it WOULD catch, do NOT block
if rule_matches(request): log_candidate(request)
# ...review the candidate list. Any real users / good crawlers in there? Re-tune.

# Stage 2 (enforce): now act
if rule_matches(request): block(request)
```

**Review the candidate list with your own eyes**, confirm no legitimate traffic is caught, and only THEN flip to enforce. Keep the observe path available even after enforcing, so you can drop back to observe **instantly** if something legitimate starts getting caught - that one-step rollback turns a potential outage into a five-minute non-event. Watch the first day of enforcement closely; that is exactly when a mis-tuned rule reveals itself by catching someone real.

**The same look-before-you-trust-it discipline applies to your monitoring as a whole.** Automation only catches what you told it to check, so run two tiers: a scheduled **automated sweep** that confirms your health and posture checks are green (are all monitors reporting? any red tiles? any check stale or a cert nearing expiry?), and a short daily **human review** that looks for what the automation missed - scanning the traffic that matched no rule at all, to spot the slow, quiet, low-volume probe that a threshold would never trip. The automated tier keeps the floor; the human tier finds tomorrow's rule. Write the daily review down as a short repeatable protocol so it is consistent and can be handed to another person or an AI assistant.

Related: [rate limiting correctly and getting the real client IP](https://www.tigzig.com/agents-faq/how-to-rate-limit-an-api-and-get-the-real-ip) (the rule you most want to observe first), and where monitoring sits overall: [https://www.tigzig.com/agents-faq/what-should-i-monitor-for-a-small-production-app](https://www.tigzig.com/agents-faq/what-should-i-monitor-for-a-small-production-app). Full item: [https://www.tigzig.com/security/monitoring](https://www.tigzig.com/security/monitoring).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/how-do-i-turn-on-a-blocking-rule-without-blocking-real-users
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms