Admin · Site protection

Site protection

Deterrents against browsing this site with developer tools and against downloading its web pages with command-line tools. Every switch applies to this site only and takes effect within a few seconds. These measures make casual copying harder; a determined person can still read any page with other tools.

Current state

state

Loading…

Presets

A preset only fills in the switches below; nothing changes until you press Save.

Browser

Console warningA large “Stop!” message in the browser console that warns visitors not to paste code there (protects against people being tricked into handing over their account).

Block right-clickNo context menu (and so no “Inspect”) on the page. Form fields, links and images keep it (copy and paste, open in a new tab).

Block developer shortcutsF12, Ctrl+Shift+I / J / C / K / E, Ctrl+U (view source) and the matching Mac shortcuts.

Detect open developer tools (debugger pause)With developer tools open, the page keeps stopping in the debugger. Also stops pages for browser automation that attaches a debugger.

Detect docked developer tools (window size)Desktop only. Only logged, never blanks the page: a zoomed page or a browser side panel looks the same.

Detect an open consoleWorks only in some browsers; harmless where it does not.

Blank the page on detectionReplaces the page with “Developer tools are not permitted on this site”. Whatever is open on that page is lost: a running sign-in, a call, filled-in forms.

Log detectionsThe server log notes the page, the reason and the address (at most 10 per address in 10 minutes).

Exempt signed-in adminsChecked on the server with the admin’s sign-in in that browser tab, so a signed-in admin can still use developer tools there (a newly opened tab counts once the admin has signed in in it).

Command-line tools (curl, wget, …)

Applies to web pages only. The APIs always work with curl, wget and every other client: all .ashx endpoints, /.well-known/, API routes without a file extension, .json files (including openapi.json), robots.txt, sitemap.xml, llms.txt, ai.txt and security.txt, and the images in /img/, /images/ and /vc-images/ that wallets load as card logos. A tool that pretends to be a browser is not recognised, and files the web server answers from its own cache may still be delivered.

Block command-line tools on web pagesRequests whose User-Agent contains one of the patterns below get 403.

User-Agent patterns (one per line, not case-sensitive, at most 20, at least 3 characters; patterns that would also match web browsers are refused)

Also block requests without a User-AgentSimple scripts and some monitoring services send none.

Where

Always allowed addresses (one per line: IP address or IPv4 range like 203.0.113.0/24, at most 20)