---
title: "General options"
manual: "HTTP Guard"
version: "main"
permalink: "https://docs.typo3.org/permalink/netresearch/nr-http-guard:configuration-options@main"
source: "Configuration/Options.rst"
rendered: "2026-10-18T14:31:38+00:00"
---

# General options {#configuration-options}

All paths are relative to `EXTCONF.nr_http_guard`.
Missing fields use the defaults below.

## Mode and addresses {#configuration-mode}

-   **schemaVersion**

    -   *Type:* integer
    -   *Default:* 1

    Only schema version 1 is accepted.

-   **mode**

    -   *Type:* string
    -   *Default:* 'enforce'

    `enforce` controls the transport and blocks denied requests.
    `observe` evaluates and reports decisions but does not block
    additional requests or provide verified transport binding.
    `disabled` disables the additional protection. The mode never
    changes automatically on error. Existing Core or Vault checks remain
    effective in their respective adapter.

-   **deniedCidrs**

    -   *Type:* list\<string>
    -   *Default:* \[\]

    Additional operator restrictions for IPv4 or IPv6. These networks
    remain denied even with a valid endpoint profile. An empty value does
    not remove built-in restrictions. IPv4-mapped IPv6 CIDRs are not
    accepted; configure the corresponding IPv4 CIDR instead.

-   **endpoints**

    -   *Type:* map\<string, array>
    -   *Default:* \[\]

    At most 128 named profiles. All profile fields are documented in
    [Endpoint profiles](https://docs.typo3.org/permalink/netresearch/nr-http-guard:configuration-endpoints@main).

## Resolver {#configuration-resolver}

-   **resolver.staticHosts**

    -   *Type:* map\<string, list\<string>>
    -   *Default:* \[\]

    Exact canonical hostnames with complete, non-empty IP lists.
    Wildcards, IP hosts as keys and operating system search domains are
    forbidden. Static responses pass the same address and endpoint checks
    as DNS responses. A static entry grants no permission by itself.

-   **resolver.cacheTtlSeconds**

    -   *Type:* integer
    -   *Default:* 5

    Range: 0 to 5 seconds. Zero disables DNS memoization. Entries never
    exceed the smallest remaining TTL in the complete response and CNAME
    chain. Negative or incomplete responses are not cached as positive
    results.

-   **resolver.cacheMaxHosts**

    -   *Type:* integer
    -   *Default:* 32

    Range: 1 to 1024. Maximum positive host entries per resolver instance.
    When the cache is full, its oldest entry is evicted.

-   **resolver.maxAddresses**

    -   *Type:* integer
    -   *Default:* 64

    Range: 1 to 64. Larger responses are rejected in full rather than
    truncated to their first permitted candidates.

-   **resolver.maxCnameHops**

    -   *Type:* integer
    -   *Default:* 8

    Range: 0 to 8. Cycles and longer chains are rejected. Zero prohibits
    following a CNAME redirect.

## Redirects and TLS {#configuration-redirect-tls}

-   **redirects.max**

    -   *Type:* integer
    -   *Default:* 5

    Range: 0 to 10. Upper limit for supported redirect paths. Endpoint
    profiles may additionally forbid redirects entirely. PSR-18
    `sendRequest()` never follows redirects, regardless of this value.

-   **tls.requireVerification**

    -   *Type:* boolean
    -   *Default:* false

    With `true`, callers cannot disable TLS verification.
    The default `false` does not disable verification itself:
    the transport normally uses `verify=true`, but permits an
    explicitly configured `verify=false` SDK option.
    `doctor` warns when policy does not require verification.
    For internal HTTPS targets, use an appropriate CA bundle and
    `requireVerification=true`.

## Logging {#configuration-logging}

-   **logging.allowedSampleRate**

    -   *Type:* integer|float
    -   *Default:* 0

    A finite number from 0 to 1. Fraction of allowed decisions to log;
    the default is zero percent. Denial counters remain available even
    when log events are rate limited.

-   **logging.hostMode**

    -   *Type:* string
    -   *Default:* 'hash'

    `hash` pseudonymizes the host using the configured HMAC key.
    Without a key, the host is omitted. `plain` logs the canonical
    host in clear text and is an explicit operator choice. Paths, queries
    and complete URLs are omitted in both modes.

-   **logging.hostHmacKeyEnv**

    -   *Type:* string|null
    -   *Default:* null

    Name of a real process environment variable containing the HMAC key.
    The name uses ASCII letters, digits and underscores, starts with a
    letter or underscore, and contains at most 128 characters.
    The key itself must not be part of a policy array or request.

-   **logging.denyRateLimitPerMinute**

    -   *Type:* integer
    -   *Default:* 60

    Range: 1 to 10000. Rate limits denial log events, never policy
    enforcement. The event format is documented in
    [Decision logs](https://docs.typo3.org/permalink/netresearch/nr-http-guard:operations-logging@main).