Use the export button in the Stream to download the logs that match your current filter. Choose a time range: the last 15 minutes, hour, 24 hours, or 7 days, or a custom range. Pick CSV with the visible columns for spreadsheets, or JSON Lines with every field for jq, scripts, or a SIEM.

Text filters in the Stream, such as contains, starts-with, and ends-with, now ignore letter case. Use contains-cs, not-contains-cs, starts-with-cs, or ends-with-cs when case must match exactly. New rule conditions also have Case Insensitive turned on by default. See Match letter case exactly.

Rate-limit actions that use the Default scope now give each client IP its own bucket. Previously the default bucket was shared by all clients, so one client could use up a limit, such as a login limit, for everyone. IPv6 clients are grouped by /64, so rotating addresses within one allocation no longer gets a fresh allowance.

Proxy v0.27.0 reads request values the way common backends do, so requests can't slip past a rule by spelling a value differently:

When you connect an AI client such as Claude, ChatGPT, or Codex to FlowGuard, you can now choose All my teams instead of a single team. The agent can then investigate logs and manage rules for every team you belong to, including teams you join later. It names the team on each request and asks you when the intended team is unclear.

Turn on Upgrade proxies automatically under Proxy upgrades in settings. Once a day, every online server that allows remote upgrades is upgraded to the latest proxy release. A release that failed to install on a server isn't retried there automatically.

FlowGuard proxies now add two headers to requests sent to your backend:

Settings now shows FlowGuard proxy usage against your team limit, logs received this month against the monthly limit, retained log count, and stored log size. Open the Usage page to see daily log volume and storage history for the last 90 days.

Rate limits can now use explicit buckets for each client IP, connection, JA4 fingerprint, domain, or path. Combine dimensions to give each unique combination its own allowance and tune limits to the traffic you want to control.

Rules can now use behavior metrics such as client request bursts, concurrent requests, and JA4 fingerprint activity. Choose a metric and numeric threshold, then pair the condition with an action to respond to unusual traffic.

The dashboard's Incident analysis view brings together the signals needed to investigate recent traffic. It shows request volume, average and peak request rates, latency, top paths, methods and countries, and related JA4 fingerprints.

Choose a date and time in your browser's timezone to load retained requests near that moment in the log stream. Browse earlier and later events for context, then return to the live stream when you are done.

FlowGuard now has an MCP endpoint at https://flowguard.network/mcp for compatible AI assistants. Connect it to inspect request logs, list the rules, actions, proxies and IP lists in your team, and investigate an event using its stream ID or surrounding log window.

The new FlowGuard API lets you bring traffic investigations and protection changes into your own workflows. Query retained request logs, discover available log fields, list FlowGuard proxies and IP lists, and create or update rules and actions with scoped access.

Enable Fail2Ban integration in a proxy's Advanced settings to bring bans from active host jails into FlowGuard. Matching HTTP requests are blocked before rules or upstream processing, and new bans are synchronized as they happen.

IP Lists now separates Your lists from Built-in lists, making FlowGuard-maintained lists easier to find. New options include Google crawlers, GitHub webhooks and hosted runners, Stripe webhooks, AI crawlers, and uptime monitoring services.

When creating entries in an IP list, paste one IP address or CIDR range per line. FlowGuard normalizes and adds valid unique entries in one action, skips invalid or duplicate lines, and reports how many were created.

FlowGuard can now load certificates from a Traefik v2 or v3 acme.json file. Enter its path in a proxy's Advanced settings, or let flowguard setup discover it, to use certificates already managed by Traefik. The proxy watches the file for renewals.

Run flowguard setup to choose how a proxy exposes the validated client address to a same-host Linux backend. Transparent forwarding preserves the client IP as the TCP source when the client and backend use the same IP family. The panel shows the selected mode and any IPv4/IPv6 address pairs.

The rule editor now has Trusted Proxy conditions for the immediate trusted proxy's IP address, ASN, and IP list membership. Use them to apply a rule based on which upstream proxy forwarded a request, separately from the original client's details.