Enforce: Gateway Setup

Goal

Set up Checkpoint Gateway to enforce AI agent policies at the DNS/edge level — no code changes required. By the end of this cookbook, you'll have:

• Traffic routing through Checkpoint's edge network
• WASM-based detection running on every request
• Automatic SSL/TLS certificate provisioning
• Policy enforcement (block, redirect, challenge) for detected agents

Best for: Protecting any website or API without touching application code. Works with any origin server.

Prerequisites

• A Checkpoint account with a project created
• A domain or subdomain you control
• Access to your domain's DNS settings

Time Estimate

10-15 minutes (plus DNS propagation time)

Steps

Type:  CNAME
Name:  shop (or your subdomain)
Value: detect.checkpoint-gateway.ai
TTL:   Auto (or 300)

Type:  CNAME
Name:  @ (or leave blank)
Value: detect.checkpoint-gateway.ai
TTL:   Auto

# Check if CNAME is set correctly
dig shop.example.com CNAME +short
# Should return: detect.checkpoint-gateway.ai

# Check if the domain resolves
curl -I https://shop.example.com
# Should return headers including x-checkpoint-* headers

Name: Block AI Agents
Condition:
  - detection_class equals "ai_agent"
Action: Block
Response:
  - Status: 403
  - Body: 'AI agent access is not permitted'

Name: Verified Agents Only
Condition:
  - detection_class equals "ai_agent"
  - signature_verified equals false
Action: Block
Response:
  - Status: 403
  - Body: 'Unverified agent access denied'

Name: Redirect Bots
Condition:
  - detection_class equals "bot"
  - agent_name not_in ["Googlebot", "Bingbot"]
Action: Redirect
Target: https://example.com/bot-notice

curl -I https://shop.example.com
# Should return 200 OK with your origin's response

curl -I -H "User-Agent: Mozilla/5.0 (compatible; GPTBot/1.0)" \
  https://shop.example.com
# Should return 403 (if blocking AI agents)

curl -I -H "User-Agent: Googlebot/2.1" \
  https://shop.example.com
# Should return 200 OK (if Googlebot is allowed)

Understanding Gateway Headers

The Gateway adds headers to requests forwarded to your origin:

Your origin can use these headers for additional logic:

// Express example
app.get('/api/data', (req, res) => {
  const detectionClass = req.headers['x-checkpoint-class'];

  if (detectionClass === 'ai_agent') {
    // Return limited data for AI agents
    return res.json({ data: 'limited' });
  }

  res.json({ data: 'full' });
});

Verify It's Working

Dashboard Verification

1. Go to Analytics in your dashboard
2. You should see requests categorized by detection class
3. Blocked requests will show in the Enforced tab

Health Endpoint

The Gateway exposes health endpoints:

# Health check
curl https://shop.example.com/__gateway/health
# Returns: { "status": "ok" }

# Readiness check
curl https://shop.example.com/__gateway/ready
# Returns: { "ready": true }

# Version info
curl https://shop.example.com/__gateway/version
# Returns: { "version": "x.x.x", "region": "..." }

Troubleshooting

DNS Not Detected

SSL Certificate Not Provisioning

• Check DNS again — Must resolve correctly before cert issuance
• Check CAA records — Remove or add Cloudflare to allowed issuers
• Cloudflare users — Ensure proxy is OFF (gray cloud)

Origin Not Reachable

• Check firewall — Allow Cloudflare IP ranges
• Check origin URL — Verify in dashboard settings
• Check HTTPS — Origin must support HTTPS

Requests Not Being Blocked

• Check policy order — Policies evaluate top-to-bottom
• Check conditions — Verify detection class matches
• Check confidence threshold — Low-confidence detections may not match

What You Learned

• How to create and configure a Checkpoint Gateway
• How to update DNS records for different providers
• How to configure enforcement policies
• How to test Gateway functionality
• How to use Gateway headers in your origin

Next Steps

Related Documentation

• Gateway Reference
• Policies
• Detection in Enforce Mode
• Monitoring