hosting
PUT /v1/sites/{siteId}/firewall
Change a site's own firewall rules.
Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X PUT https://api.zinndigital.com/v1/sites/{siteId}/firewall \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
A partial update: an absent field is left as it is. Every control only tightens the site; none can loosen a platform rule. challenge_hours turns on the "check every visitor" mode for that many hours (1-24; 0 switches it off) and it switches itself off on time. admin_trusted_only needs at least one trusted address, or the owner could not sign in — refused 422. Answers 202: the change is saved and pushed to the server as a background job; apply_state is pending until the server has proven it live, then applied (or failed, with apply_error). Requires sites.view and sites.panel_access.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
siteId (path) | Uuid | Yes | Site ID (UUIDv7). |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
login | string<standard, strict> | No | — |
xmlrpc | string<limited, blocked> | No | — |
rule_sets | string<block_author_scans, block_php_in_uploads, block_info_files, block_aggressive_bots>[] | No | — |
trusted | string[] | No | IPv4 addresses, IPv4 ranges ending /8, /16 or /24, or single IPv6 addresses. |
admin_trusted_only | boolean | No | — |
challenge_hours | integer | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
site_id | string | Yes | — |
login | string<standard, strict> | Yes | Login attempts per visitor per 5 minutes — standard 10 (the platform floor), strict 5. |
xmlrpc | string<limited, blocked> | Yes | limited: XML-RPC answers under the login limit; blocked: refused outright. |
rule_sets | string<block_author_scans, block_php_in_uploads, block_info_files, block_aggressive_bots>[] | Yes | — |
available_rule_sets | string[] | Yes | — |
trusted | string[] | Yes | Addresses never challenged and exempt from the site's own rule sets. |
admin_trusted_only | boolean | Yes | Only trusted addresses may reach the login page and wp-admin. |
challenge_until | object | Yes | The customer's own "check every visitor" mode runs until then; null is off. |
platform_rules | string[] | Yes | Always-on platform rules (keys). Not editable. |
apply_state | string<applied, pending, failed> | Yes | — |
applied_at | object | Yes | — |
apply_error | string | Yes | — |
flood | SiteFirewallFlood | null | Yes | — |
recent_floods | SiteFirewallFlood[] | Yes | — |
Errors this endpoint can return
401 · 403 · 404 · 422 · 429