Deny List

What is the Deny List?

The Deny List lets you manually block specific traffic sources that you've identified as unwanted. Entries on the deny list are checked before other detection methods and take the highest priority in policy evaluation.

Use the deny list when you want to:

• Block known bad actors by IP address
• Block specific scrapers by user agent string
• Block repeat offenders by browser fingerprint
• Respond immediately without waiting for detection

How It Works

The deny list is evaluated at the top of the policy evaluation order:

1. Allow list (highest priority)
2. Deny list ← checked here
3. Path-based rules
4. Confidence threshold
5. Default action

When a request matches a deny list entry, it is immediately blocked (HTTP 403) without further detection processing. This makes deny list lookups fast and deterministic.

Managing the Deny List

Dashboard

Navigate to your project in the Checkpoint dashboard, then go to Settings → Deny List.

From the deny list page you can:

• Add entries — Block an IP, user agent, or fingerprint
• View existing entries — See all active blocks with metadata
• Remove entries — Unblock previously denied sources
• Search and filter — Find entries by type or value

Supported Block Types

Blocking by IP Address

Single IP

Block a specific IP address:

1. Go to Settings → Deny List
2. Click Add Entry
3. Select type: IP Address
4. Enter the IP: 203.0.113.42
5. Add an optional note (e.g., "Aggressive scraper detected 2026-01-15")
6. Click Add

CIDR Range

Block an entire IP range:

1. Select type: IP Address
2. Enter the CIDR range: 203.0.113.0/24
3. This blocks all 256 addresses in the range

Finding IPs to Block

Use the Monitor tab to identify suspicious IPs:

1. Go to your project's Monitor tab
2. Filter by detection class: AI Agent or Bot
3. Sort by request count to find high-volume sources
4. Click an entry to see the IP address
5. Add the IP to your deny list

Blocking by User Agent

Exact Match

Block traffic with a specific user agent string:

1. Select type: User Agent
2. Enter the full user agent string
3. Only requests with an exact match are blocked

Pattern Match

Block traffic matching a user agent pattern:

1. Select type: User Agent Pattern
2. Use * as a wildcard: *scraper* matches any user agent containing "scraper"

Common patterns to consider:

Blocking by Fingerprint

Browser fingerprints are unique hashes derived from client-side signals (screen resolution, installed fonts, WebGL capabilities, etc.). Fingerprint blocking is effective against repeat offenders who rotate IP addresses.

Finding Fingerprints

1. Go to the Monitor tab
2. Click on a detection entry
3. Copy the Fingerprint hash from the detail panel
4. Add it to the deny list

Limitations

• Fingerprints require client-side detection (Pixel or Beacon)
• Fingerprints are not available for server-side-only detections
• Fingerprints can change when browsers update

Deny List vs Allow List

Both lists are configured per-project. The allow list is checked first — if a request matches the allow list, the deny list is skipped entirely.

Deny List vs Detection Policies

Use the deny list for sources you've already identified. Use detection policies for automated classification of unknown traffic.

Best Practices

1. Start with detection — Use Checkpoint's detection to identify threats before manually blocking
2. Add notes — Always add a reason when creating deny list entries for future reference
3. Review periodically — IP addresses and user agents change; review your deny list quarterly
4. Use CIDR carefully — Prefer single IPs over ranges to minimize false positives
5. Prefer detection — For sophisticated threats, multi-signal detection is more reliable than deny list entries
6. Combine approaches — Use the deny list for known bad actors and detection policies for everything else

Next Steps

• Policies — Configure automated enforcement rules
• Detection — Understand multi-signal detection
• Dashboard Analytics — Identify traffic to block
• Managing Projects — Project settings overview