---
title: Block user agents and lock zones · Cloudflare Learning Paths
description: User Agent (UA) Blocking rules match against specific User-Agent
  request headers sent by the browser or application accessing your site. UA
  rules are applied against the entire domain, and after a rule is triggered,
  you can decide which action to take against the visitor.
lastUpdated: 2025-09-25T16:31:00.000Z
chatbotDeprioritize: false
source_url:
  html: https://developers.cloudflare.com/learning-paths/surge-readiness/security/block-agents-lock-zones/
  md: https://developers.cloudflare.com/learning-paths/surge-readiness/security/block-agents-lock-zones/index.md
---

[User Agent (UA) Blocking](https://developers.cloudflare.com/waf/tools/user-agent-blocking/) rules match against specific User-Agent request headers sent by the browser or application accessing your site. UA rules are applied against the entire domain, and after a rule is triggered, you can decide which action to take against the visitor.

Actions:

* Block: Ensures that an IP address will never be allowed to access your site
* CAPTCHA Challenge: Rules will be shown a CAPTCHA before allowed access
* Javascript Challenge: Rules will be shown 5 second javascript confirmation

## Zone Lockdown

[Zone Lockdown](https://developers.cloudflare.com/waf/tools/zone-lockdown/) rules allow you to define paths and only allow specific, trusted IPs to those paths. Any requests to those paths from non-whitelisted IPs will be automatically blocked with an 1106 HTTP code. This ability is particularly useful for locking down administrative or staging portions of your application.
