# Under attack mode for OpenWAF Verify

> One switch puts every page of a zone behind the browser challenge during an attack, with exempt paths for webhooks and an automatic end.

[Under attack mode](https://developers.openwaf.dev/waf/under-attack/) puts the browser challenge in front of the whole zone while it is under an application-layer flood or a scraping wave. Every browser navigation without a valid `__waf_pass` gets the proof-of-work page («Checking your browser before accessing www.example.com»), on `api.*` names too, and every other request without a pass gets `403` with `{"error":"challenge_required",…}` and `OpenWAF-Mitigated: challenge`, never the HTML page. By default the challenge is one bit harder than the name's usual one, and you can also shorten the pass lifetime.

Paths in `exempt_paths` (webhooks, payment callbacks), IP and ASN `allow` rules, WAF exceptions with `rule_id` 0 and verified crawlers skip it, so search engines keep indexing; a request that only claims to be a crawler is challenged. `hosts` limits it to some names of the zone. Set `until` and the control plane switches it off at that time as a new zone version, recorded in the history and the audit log.

Turn it on from the zone overview or **Security → Verification** (1 h, 6 h, 24 h or until you turn it off), with `openwaf-cloud ctl zones under-attack example.com on --for 6h --reason "…"`, with `challenge.under_attack` in `PATCH /v1/orgs/{org}/zones/{zone}/edge`, or with the new MCP tool `under_attack`. Its challenges appear under the `under_attack` trigger in the Verification analytics.