Enter an IPv4 or IPv6 CIDR range directly in an IP Address rule condition. You can match a single range or include ranges alongside individual addresses in an in-list condition, so a known network does not need its own IP list.

In the rule editor, you can now add conditions for the HTTP method, a named query parameter, or a named cookie. Combine them with existing conditions to target specific requests, such as POST requests with a particular parameter value.

Run flowguard setup <host-key> on a proxy host to fetch its configuration. In an interactive terminal, setup can detect a Plesk certificate directory or NGINX configuration path, ask you to confirm it, save the selected path to the control panel, and download the updated configuration.

When creating or editing a rule, use the Servers field to choose All servers, Only selected servers, or All except selected servers. This lets you roll out a rule to a subset of your proxies or keep it away from particular servers without duplicating the rule.

A shared rule page now shows how many requests the rule allowed, blocked, challenged, rate limited, or logged in the last 24 hours, according to its action. This gives someone reviewing or importing the rule a quick sense of its recent activity.

Open Log Details in Stream to investigate a value without copying it into another tool. Client and proxy IP addresses link to RDAP, WHOIS, and PTR lookups; domains link to DNS, RDAP, and WHOIS; ASNs link to RDAP and WHOIS.

Stream now exposes response resource details, including type, MIME value, file extension, and whether a response looks like a static asset. Add these as columns or filter on them to separate pages, API responses, images, scripts, and other resources while investigating traffic.

In Settings → Trusted Proxies, choose existing team or built-in IP lists whose addresses may supply the real client IP through forwarding headers. You can add or remove lists and restore the defaults.

Create a Challenge action and attach it to a rule to require a browser proof-of-work check before a matching request reaches your application. Visitors who pass receive a clearance cookie for that rule, while non-HTML clients receive a machine-readable response with a challenge URL.

Open a rule or action to see its own traffic dashboard. The graph and tables show request results and top domains, agents or JA4 fingerprints, networks, and servers for the selected time range; result filters help narrow what you are reviewing.

Stream now shows a JA4 Fingerprint field for HTTPS and HTTP/3 requests, and the rule editor can match that fingerprint. Use it alongside IP, ASN, user agent, and path conditions to investigate or respond to groups of clients with similar TLS behavior.

Edit a server to enable HTTP/1, HTTP/2, or HTTP/3 individually. When HTTP/3 is enabled, you can also choose whether FlowGuard advertises it with an Alt-Svc header on HTTPS responses.

Use the command palette to search your team's servers, rules, actions, and IP lists from anywhere in FlowGuard, then jump straight to the result. It also offers shortcuts for common creation and team tasks.

FlowGuard now supports a dark interface across the panel. Use the theme switcher in the app shell to choose your preferred appearance or follow your system setting.

Rule groups now include Match unless all of these are true and Match only if none of these are true. Use these options to exclude a particular combination of conditions or require that every listed condition be absent.

In the rule editor, drag a condition or condition group by its handle to change the order or move it into another group. This makes it easier to build and revise nested rules without deleting and recreating matches.

Add a comment to an IP list entry to record why an address or range belongs there. On an IP list's entries page, search by IP address, CIDR range, comment, or entry ID to find the record you need.

Open a request in Stream and select Block IP to add its client address to the team's Blocked IPs list. You can block one address or a wider range: IPv4 offers a single address or /24; IPv6 offers a single address, /64, or /56. FlowGuard creates the required blocking rule and action when needed.

The weekly email summarizes the previous week's requests, blocks, and rate limits for each server, alongside its current status and whether an update is available. It also highlights the busiest server and links back to the Servers page.

From Servers, choose Upgrade all eligible servers to update several proxies without opening each one. FlowGuard upgrades them one at a time, shows which server is in progress, and stops on the first error so you can investigate before continuing.