This series described five layers and what each one actually did on this site. Here is the model in one place, including the point where we part company with the standard recommendation.
Five layers, one site, and every layer measured before and after.
The five layers
| Layer | What it decides | Where we diverge |
|---|---|---|
| 1. Edge | Refuse probe fingerprints before they reach the server | No JavaScript challenge: retrieval crawlers do not run it, and they are the clients we want |
| 2. Server | Refuse paths that should never resolve | No silent 444: we publish 403 as part of a verifiable contract |
| 3. Behaviour | Bound abuse of endpoints worth abusing | No automatic IP bans: our crawler and scanner traffic share address ranges |
| 4. Honeypot | Detect the requests nobody legitimate makes | No fingerprinting theatre: address, agent, order and timing only |
| 5. Reporting | Turn defence into something checkable | No address blocklist: the loop closes on path families instead |
What the numbers looked like
In our own window: 71,191 requests, of which 40,263 were refused and 33,133 matched known scan paths; the top five probe paths were /v1/graphql (857), /api/graphql (845), /graphql (831), /api/config (814) and /actuator/loggers (533).
The single most useful measurement was not a count but a comparison: refusing the same requests at the origin left the published number unchanged, because the number reads what reaches the server. Only the layers that decide before arrival can move it.
The parts, in order
- Layer 1: Blocking at the Edge, and Why We Do Not Challenge
- Layer 2: Server Hardening, and the 403-vs-444 Question
- Layer 3: Behaviour Analysis Without Hurting Your Crawlers
- Layer 4: Honeypots as Early Warning (and Their Limits)
- Layer 5: Closing the Loop in Public
- The measurement that started the series: what happened when we blocked scanner traffic
How to check any of it
- Edge vs Origin Check for any domain.
- /data/live.json for counts and definitions; /data/health.json for freshness.
- /live/ for the live view and /reports/ for the frozen record.
Which layer matters most?
Server hardening, because it depends on nobody else and covers the paths that should not exist. Edge blocking is the one that changes the published volume.
Can these five layers replace a WAF?
They overlap. A WAF is where layer one usually lives; the other four run whether or not you have one.
Why publish the disagreements?
Because the standard advice is usually right for a different kind of site - one without a public contract and without crawler-dependent traffic. Ours is neither.
Related reading: Layer 5: Closing the Loop in Public · Layer 4: Honeypots as Early Warning (and Their Limits)
More on this site: live signals · dated reports · how to verify us