> ## Documentation Index
> Fetch the complete documentation index at: https://docs.vexaris.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Fraud protection and audit logs

> Blacklist rules that stop bad checkouts, the log they write, and the panel audit trail.

Two safety nets live in the panel: **Fraud Protection** acts at checkout and login, the **Audit Log** records what staff did in the panel.

## Fraud Protection

Find it under **Settings → Fraud Protection**, in four tabs: Overview, Blacklist, Fraud Logs and Settings.

### Rule types

| Type | Blocks on | Plan |
| - | - | - |
| IP | One visitor address | All plans |
| IP range | A subnet, for example a whole hosting block | All plans |
| Country / City | Geo of the visitor | All plans |
| ISP | Network the visitor rides on | All plans |
| Email / Email domain | Buyer address or its domain | All plans |
| Bot | Automated traffic fingerprint | All plans |
| VPN / Tor / Temp Mail | Anonymising and disposable services | Professional and above |

### Rule behaviour

| Option | Effect |
| - | - |
| Action **Block** | The request is cut with a 403, checkout never happens |
| Action **Log** | Only a record is written, the buyer proceeds |
| Match exact or regex | Plain value, or a pattern for advanced rules |
| Scope | Apply to checkout, login, or both |
| Window and methods | Limit a rule to payment methods or a date range, for campaign nights |

Rule slots are limited per plan: 20 on Free, 200 on Starter, unlimited above. VPN, Tor and Temp Mail detections run in log mode only until Professional, they warn without blocking.

### Settings tab

* **Mode**, one switch from log only to active blocking, the overview banner reminds you when the store is still in log mode
* **Geo and ISP lookup**, lookups are cached per address, and when the geo service is unreachable checks go passive for a while instead of blocking honest buyers
* **Whitelist**, your own IPs or CIDR ranges, one per line, never test a block rule against your own checkout without it

### Overview tab

Blocked today, blocked over 30 days, unique blocked addresses, a per day chart, which rules blocked the most, and where blocked buyers came from. It is the fastest way to see whether your rules are protective or over eager.

> [!WARNING]
>
> Country and ISP rules are sledgehammers. One misconfigured range can lock out a whole city of honest customers. Ship new geo rules in Log mode, watch the Fraud Logs for a day, then switch to Block.

## Audit logs

**Settings → Audit Logs** records panel changes: product edits, license suspensions, coupon deletions, role changes, who did them and when. Filter by resource (products, orders, licenses, reviews, coupons and more) and by action (created, updated, deleted).

Use it in three situations:

1. Something changed and nobody knows how, find the account and the minute
2. Staff handover, prove what was touched the day you changed teams
3. A dispute, show that a license was suspended after a chargeback, not before

> [!NOTE]
>
> The audit log is written by the panel, it is not a customer activity feed. Customer side events live in credit logs, fraud logs and the order list.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.