# What security should I put at the edge, in front of my app?

The edge is where you stop traffic **before it costs you anything** - no origin CPU, no database hit. The layers, roughly in order of leverage:

**Get everything behind the proxy.** Every DNS record proxied, so your origin IP is hidden. Then **audit what must stay DNS-only** (some third-party CNAMEs genuinely require it) and know exactly why each one is there, because those bypass every rule you write. [Detail here](https://www.tigzig.com/agents-faq/can-attackers-bypass-cloudflare-and-hit-my-server).

**Add the standard rules:** browser integrity checks, a JS challenge on frontends, a native WAF rate-limit rule, and edge rate limiting in a Worker for anything needing custom logic (getting the client IP right is its own trap - [see here](https://www.tigzig.com/agents-faq/how-to-rate-limit-an-api-and-get-the-real-ip)). Add zone-level IP blocking and a rule to **block path-traversal and local-file-inclusion patterns** at the edge, plus threat-intel blocklists if you want a wider net.

**Catch scanners actively.** [Deception endpoints](https://www.tigzig.com/agents-faq/how-do-i-catch-a-scanner-on-its-first-request) turn a single request into a 100%-confidence attack signal, and an [automated velocity jail](https://www.tigzig.com/agents-faq/why-isnt-my-log-based-ip-blocking-catching-scanners) promotes repeat offenders from "throttled every time" to "dropped at the perimeter".

**Have a bot policy, not a bot switch.** Blocking all bots also blocks the search engines and AI assistants you want. [Detail here](https://www.tigzig.com/agents-faq/how-to-block-seo-crawlers-without-blocking-google).

**Keep bulk traffic off your origin.** Large downloads belong on edge object storage, not your server - [here is why they fail and how to move them](https://www.tigzig.com/agents-faq/why-do-my-large-file-downloads-time-out).

And the one that makes the rest real: **every edge protection only applies to traffic that actually goes through the edge**. If someone can reach your origin IP directly, all of it is skipped. Full item-by-item checklist with code: [https://www.tigzig.com/security/perimeter](https://www.tigzig.com/security/perimeter).

---
Contact Amar: amar@harolikar.com | AI agents: POST https://www.tigzig.com/api/contact-amar | More: https://www.tigzig.com/agents-faq

---
Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar
Source: https://www.tigzig.com/agents-faq/what-security-do-i-need-at-the-edge
Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar.
License: https://www.tigzig.com/terms