Settings

Get security settings

read Read: looks, changes nothing. Scopes

Response#

200 OK

• rule_datacenterboolean

  Treat a viewer whose ASN belongs to a hosting provider as a restreamer — a real customer watches from home, not from a rented server. IPs recognised as consumer VPN exits are excluded, so a customer using NordVPN or Surfshark is not caught by this rule.

• rule_pull_tool_uaboolean

  Treat ffmpeg, GStreamer, curl, streamlink and similar tools as restreamers rather than players. Cheap and precise, but easy to fake: a restreamer only has to call itself a player.

• rule_many_sessionsboolean

  Treat a line running several simultaneous sessions from a single IP as a restreamer, unless the line is flagged as an authorised restreamer. This is the fan-out signal and the hardest to fake — the connections are counted on our side.

• many_sessions_thresholdinteger

  How many simultaneous sessions from the same IP trip the rule above. A household with several TVs is normal; keep this above the largest family you sell to.

• rule_long_sessionboolean

  Treat a session that never stops as a restreamer. A person watches for hours and then stops; a relay holds the channel open indefinitely. Cannot be spoofed — it is measured, not declared.

• long_session_hoursinteger

  Default 36 (a day and a half). Set it above anything a real viewer could plausibly do, including a TV left on overnight.

• block_restreamersboolean

  When on, a connection the rules call a restreamer is refused (403) unless its line is flagged as an authorised restreamer. On by default, so a new panel is protected from the first stream rather than after someone remembers to arm it. Watch the Live Connections monitor early on and switch off any rule that catches real customers, because a viewer refused this way is not told why.

• auto_blockboolean

  Blocks an address for a while when it guesses passwords or floods the panel: sign-in, playlists and streams are all refused there, on the panel and every streaming server. Your servers, Cloudflare, and addresses where two or more of your customers are watching are never blocked; failed sign-ins never block an address where an admin signed in during the last 30 days. Locked out? On the panel's server run "docker compose exec web uv run python manage.py unblock

  " in /opt/iptv-panel.

• signin_guardboolean

  Too many failed sign-ins to this panel (the dashboard or the admin) from one address.

• signin_failuresinteger

  From one address, within the time below. Past it, sign-in from there is refused before any password is checked.

• signin_window_minutesinteger

  How far back failed sign-ins are counted.

• guess_guardboolean

  Too many different wrong usernames and passwords from one address in playlist links, player logins, channels, films, catch-up and the TV guide. A player that keeps retrying the same old password counts once.

• guess_limitinteger

  From one address, within the time below.

• guess_window_minutesinteger

  How far back wrong passwords are counted.

• flood_guardboolean

  Far more requests to this panel from one address than anyone sends, without a valid login. Plays, playlists and player apps signed in with a real account never count. Big attacks from many addresses need your hosting provider or Cloudflare.

• flood_per_minuteinteger

  Requests a minute from one address that sign in with nothing valid. Plays, playlists and player logins with a real account (one that may watch) never count.

• block_minutesinteger

  How long the first automatic block of an address lasts.

• block_max_hoursinteger

  An address blocked again within a day of its last block is blocked twice as long each time, up to this.

• never_blockstring

  One address, block (198.51.100.0/24) or range per line: never counted and never blocked automatically. Blocking one by hand still works.

• trust_own_proxyboolean

  Only for a panel installed without its own web server. Attack protection stays paused until you turn this on, because anyone could pretend to be another address and get it blocked. Turn it on only when the panel's port can be reached from your proxy alone (the installer publishes it on 127.0.0.1 unless told otherwise), and your proxy sets the header chosen below itself. CF-Connecting-IP is believed only from Cloudflare's addresses.

• proxy_headerstring

  With X-Forwarded-For, the panel reads the last address in it: the one your proxy added. If another CDN than Cloudflare sits in front of your proxy, make it pass the visitor's address, or its addresses get counted.

  • x-forwarded-for - X-Forwarded-For
  • x-real-ip - X-Real-IP
• proxy_addressesstring

  One address or block per line, as the panel sees your proxy. A proxy on the panel's private network needs none, except one that reaches it through Docker's gateway (a proxy on this server, through a published port): list that gateway here.

• hash_budget_per_minuteinteger

  Shared by every address already at half its limit of wrong passwords: checking a password costs CPU, so past this they wait a minute. Other addresses, an admin's own sign-in and passwords the panel already knows are never held back. 0: 60 per CPU core of this server.

• under_attackboolean

  For when the panel is being attacked: every check runs, even one switched off, limits drop to about a quarter and blocks last four times as long. Your team, your servers and private networks are still never blocked, but customers who share an address (a mobile network, an office) may be refused more often. Every page shows a red banner while it is on.

• under_attack_sincestring (date-time)requiredread-onlycan be null
• under_attack_hoursinteger

  So a busy day does not leave the panel strict for good. 0 keeps it on until you turn it off.

• updated_atstring (date-time)requiredread-only
• diagnosticsobjectrequiredread-only

  What each rule can do on this panel, so the page can grey out a switch that would never match: *_available (the rule has the data it needs), vpn_exclusion_available, and acts_on (whether a rule refuses a request or ends a session already playing).

• limitsobjectrequiredread-only

  Each attack protection number's bounds, read off the model, so the page holds no copy of them.

• protectionobjectrequiredread-only

  Whether attack protection runs and what it did lately: running, own_proxy, blocked_today, in_force, gateways, hash_budget_auto, gateway_requests, under_attack ({since, ends, running} while Under attack is on, else null) and strict (the limits while it is on).

Errors#

• 401 No credential, or one that is wrong, expired or revoked.
• 403 The account, or the key's or app's scopes, may not do this.
• 429 Slow down: wait the seconds in the Retry-After header, then try again.

What each error means