Traffic rules
Not every click deserves your landing page
A short link is a door, and right now it opens for everyone: the buyer you paid for, the scraper building a competitor’s price list, the click farm inflating someone’s report. Traffic rules put a condition on that door — up to twenty ordered rules per link, evaluated at the edge before the redirect is chosen, with no extra lookup for links that have no rules at all.
Conditions describe a visitor, not a guess
Every rule is a set of conditions joined by “and”, and the first rule that matches decides the outcome. The conditions are the ones you would actually reason about: which country, region or city the visitor is in; which network they came from, by autonomous system number; whether that network is a data centre, a commercial VPN, a public proxy, a TOR exit node or a web anonymiser; what the visitor classifier concluded about them and how low it scored them; whether a declared crawler is genuine; device, language, referring page, user agent pattern, presence of campaign tags, local time of day, day of week, and whether this is a first or a repeat visit.
Two of those deserve a note, because they are the ones competitors cannot offer. The network type comes from a proxy database keyed by address range, not from a blocklist of user agents, so a scraper that calls itself Chrome is still recognised as a data centre. And “verified crawler” is an address check, not a name check: a request claiming to be Googlebot from a residential ISP is not Googlebot, and the rule engine knows the difference.
Conditions are three-valued on purpose. A condition can be met, not met, or unanswerable because the data is missing — and “unanswerable” never counts as a match. Inverting a condition inverts only a confident answer, so a rule written as “everyone except Germany” does not quietly fire on visitors whose country could not be resolved.
- Visitor type, verification and quality score from the classifier
- Network type: data centre, VPN, public proxy, TOR, web proxy
- Country, region, city, autonomous system number, address or subnet
- Device, language, referrer, user agent pattern, campaign tags
- Local hour window, weekday, first visit versus repeat visit
- Reusable address lists — one list, referenced by many rules
Five outcomes, and none of them is a dead end
A matched rule can let the visit through and merely record that it matched; return the link as unavailable with 404 or 410; send this visitor to a different destination; show a branded stub page with your own text; or mark the visit as suspicious without changing where it goes.
The “let through and record” action exists because a filter you cannot audit is a filter you cannot trust. Every match is written into the click event with the rule identifier and the action taken, so the Filtered breakdown answers “how much traffic did this rule stop, and did it stop the right traffic” — including for rules you have since edited or deleted, because the action is stored alongside the identifier.
Blocking with 404 deliberately returns the ordinary not-found page. A blocked link has to be indistinguishable from a link that never existed: anything else tells the person probing your links that they found something worth probing.
Rules for one link, rules for the whole workspace
Most policies are not about one link. A workspace-wide rule set applies to every link a client owns and is evaluated after that link’s own rules, so a link can carry an exception above a general ban: “close everything from data centres” at the workspace level, “let our monitoring through” on the one link the monitor watches. Any link can also opt out of the shared set entirely.
Before a rule goes live you can run it against a hypothetical visitor — country, device, network type, time — and see exactly which rule fires and where the visitor lands. The preview is not a reimplementation: it calls the same pure function the edge worker calls, and an end-to-end test compares its answer against the real Location header of a real redirect.
The cost of a rule is a design constraint, not an afterthought
Filtering happens on the path to the redirect, which is the one place where milliseconds are visible to a human being. So the engine asks only for the data the rules of that specific link actually need: a country condition triggers a geo lookup, a proxy-type condition loads the range set, a verified-crawler condition reads a cache entry. A link with no rules performs not one additional read — that is asserted by a test with call counters, not by hope.
Whatever the rules did fetch is handed to the background task that assembles the click event, so the same lookup is never paid for twice.
Frequently asked questions
Will filtering slow my redirects down?
Links without rules are untouched: no extra lookup happens at all. Links with rules fetch only what their conditions require, and the lookups run against data structures built for the edge rather than against a remote database. The rule evaluation itself is a pure function over already-fetched values.
What happens to traffic I block — is it lost from reports?
No. A blocked visit is still recorded as a click event, with the rule identifier and the action, and shows up in the Filtered breakdown. The visitor gets a 404, a 410 or your stub page; you get the evidence that the filter is working.
Can I filter by IP address?
Yes, by individual addresses and by subnets, up to a thousand entries in one list. Lists are reusable: define “office network” once and reference it from as many rules as you like. The redirector never fetches a list at request time — lists are expanded into the link’s cached configuration when you save.
Is this the same as bot detection?
Bot detection is one of the inputs. The classifier decides what kind of visitor this is; traffic rules decide what to do about it. You can block only data centres and let verified search crawlers through, or route low-quality traffic to a stub page instead of blocking it outright.
Launch your branded link shortener
Connect a domain, publish your prices and invite your first customer — most partners go live in an evening.
No card required for the trial.