Firewall DDOS (Anubis): “Verification in progress” page or 403 error on your site

Procédure

Your site displays a “Verification in progress” page, or Google Search Console, a bot, or an external service receives a 403 error? It is most often the DDOS Firewall (Anubis) of your LWS Panel hosting, the protection that filters traffic sent in bulk to saturate your site. This guide explains what it does, how to configure it yourself, and how to check the result.

What the DDOS Firewall (Anubis) does

A DDoS attack sends a very large number of requests to a site to make it inaccessible. The DDOS Firewall detects abnormal behavior and only lets legitimate requests through. It relies on Anubis, a tool that makes the visitor’s browser verify that it is indeed a browser. This verification uses JavaScript.

It is enabled by default, with the filter “Partial: Automatic detection”. Most of your visitors see nothing, or a short verification page.

You can recognize it by these signs:

• a “Verification in progress” page that appears before your site;
• a 403 error (“access forbidden”) in Google Search Console, for example “Unable to fetch the sitemap”;
• a bot, extension, or external service (synchronization, webhook, API) that can no longer reach your site;
• responses that include X-Anubis headers, if you know how to read HTTP headers.

Configuring the DDOS Firewall from the LWS Panel

1. Open your hosting management

   In your LWS customer area, open “Domains & Hosting”, then click “Manage” next to the relevant hosting account.

2. Open the DDOS Firewall

   In the “Security” section of the dashboard, click “DDOS Firewall (Anubis)”. The “DDOS Firewall Configuration” window opens over the dashboard.

   

3. Choose the setting that fits your situation

   “Current status” indicates whether protection is active. Then choose:

   • Normal use: “Enable firewall” set to “Yes (recommended)” and “Filter type” set to “Partial: Automatic detection”. This is the default setting.
   • Your site is under attack: keep “Yes (recommended)” and choose “Full: I am under attack (Under attack)”. This filter is stricter: use it only for the duration of the attack, then return to “Partial: Automatic detection”.
   • A legitimate bot or service is blocked: set “Enable firewall” to “No” to test.

4. Save

   Click “Save”. The “Current status” will show the new state.

Check that the block has been lifted

After saving, repeat the test that was failing:

• Google Search Console: use “Test live URL” on the relevant page, or resubmit your sitemap. The 403 error should no longer appear.
• External service or extension: restart the synchronization or call that was failing.
• Visitors: open your site in a private browsing window; it should display without a verification page if you have disabled the firewall.

Frequently asked questions

Related articles

• Anti-DDoS Filter - management policy in the event of a DDoS attack
• Web application firewall
• How to configure the IP Firewall
• How do you link your domain name to Google Search Console?