> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Manually install the Akamai EdgeWorker Enforcer v4

If your organization uses **Akamai**, you can use HUMAN's **Akamai EdgeWorker Enforcer** to protect against malicious behavior. The Enforcer is installed using an Akamai EdgeWorker and deployed to your content delivery network (CDN). The Enforcer dictates how traffic should be handled per your organization's standards.

You can learn how to install the Akamai EdgeWorker Enforcer with this article.

> **Warning**
>
> We **highly recommend** using the [Deploy Tool](/applications/general/deploy-tool) method instead of a manual installation if possible. See [Akamai EdgeWorker's primary installation article](/applications/akamai-edgeworker/v4/installation) for more information.

## Prerequisites

* An Akamai account with editor access to the following:
  * EdgeWorkers
  * Property Manager
  * NetStorage
  * EdgeKV (optional)
* Node v18.x or later

> **Warning**
>
> Sometimes, you may encounter a 500 error when the EdgeWorker initialization exceeds the CPU limit for your resource tier. For example, you may see response headers such as:
>
> ```bash
> status=InitCpuTimeoutError
> init_cpu_time=60
> res_tier=200
> ```
>
> This error comes from Akamai EdgeWorker's runtime limits and not HUMAN's service. To resolve this, we recommend moving to a higher [Akamai EdgeWorker resource tier](https://techdocs.akamai.com/edgeworkers/docs/resource-tier-limitations).

## Installation

The Akamai installation consists of three parts. If you prefer not to have HUMAN set up your Akamai EdgeWorker, Property Manager, and NetStorage, then you will need to complete this process yourself. Be sure to complete each part in order.

1. [NetStorage Creation](#netstorage-creation)
2. [EdgeWorker Creation](#edgeworker-creation)
3. [Property Manager Setup](#property-manager-setup)

### NetStorage Creation

1. From your Akamai account’s main menu, navigate to **Origin Services > NetStorage > Storage Groups.**
2. Select **+ Add Storage Group.**
3. Complete the steps that appear to create your storage group. You can update fields as appropriate for your organization or leave them as their defaults. However, note the following **exceptions:**

   * **Storage Group Details > Access Control Group:** Select the same group as the **Property Manager** that you will be editing for this setup.
   * **Directory Settings:** When creating a directory, we recommend naming it **px.**

> **Warning**
>
> If you do not name the directory "px", then you will need to update all related rules matching this NetStorage path in the Property Manager with the different directory name that you chose.

4. Select **Create.** The storage group will begin to propagate.
5. Once the group has propagated, navigate to **NetStorage > Upload Accounts.**
6. Either **upload** a new user or **edit** an existing one. Ensure the user has the following settings:
   * **Access Methods > NetStorage HTTP CMS API:** Select **+ Add HTTP API key** and **Save.**
   * **Access Methods > File Manager:** Toggle on **Enable File Manager Access.**
   * **Upload directory association:** Select the directory you created in **Step 3.**
   * **Upload directory association > Access:** Ensure the user has **read** and **write** access.
7. **Create** or **Save** your account.
8. Navigate back to **NetStorage > Storage Groups.**
9. Select the group you created in **Step 3.** Then, select **File Manager.**
10. Select the **px** directory you created in **Step 3.**
11. Select **Upload** and upload the **c.js** and **b.js** files provided by HUMAN. `c.js` is used for the HUMAN Challenge page, and `b.js` is used for the hard block page.

Once you’ve uploaded your files, you’re ready to move on to [EdgeWorker creation.](#edgeworker-creation)

### EdgeWorker Creation

1. Clone the [Akamai EdgeWorker HUMAN Enforcer template](https://github.com/PerimeterX/akamai-edgeworker-enforcer-template) from GitHub.
2. If you have [EdgeKV](https://techdocs.akamai.com/edgekv/docs/add-edgekv-to-your-contract) access and want to utilize the remote configuration feature, then navigate into the `remote_config_example` directory and replace the `edgekv_tokens.js` file with your own [EdgeKV tokens](https://techdocs.akamai.com/edgekv/docs/generate-and-retrieve-edgekv-access-tokens). Otherwise, navigate into the `basic_example` directory.
3. Run the commands `npm install` and `npm run build:worker`. This will install dependencies and create a build.tgz file in the dist directory.
4. From your Akamai account’s main menu, navigate to **CDN > EdgeWorkers.**
5. Select **Create EdgeWorker ID.**
6. Complete the following fields:
   * **Name:** Enter a name for your EdgeWorker.
   * **Group:** Select the same group as the Property Manager that you will be editing for this setup.
   * **Resource tier:** Select Dynamic Compute.
7. Select **Create EdgeWorker ID.**
8. Select the **ID** of the EdgeWorker you just created.
9. Select **Create Version.**
10. Upload the **tgz** file provided by HUMAN and select **Create version.**
11. From the **Actions** menu, select **Activate version.**
12. Choose whether to activate it on your **staging** or **production** network.

> **Note**
>
> We recommend activating on both staging and production. This way, when your Property Manager setup is complete, you can freely activate the configuration to either staging or production without going back to your EdgeWorker later.
>
> If you do choose to activate on both, then you will need to do Steps 10 and 11 twice—once for each network.

Once your EdgeWorker is activated, you’re ready to move on to [Property Manager setup.](#property-manager-setup)

### Property Manager Setup

Setting up the Property Manager requires adding Property Manager Variables to configure the HUMAN EdgeWorker Enforcer and Property Manager Rules to trigger the HUMAN EdgeWorker Enforcer.

1. From your Akamai account’s main menu, navigate to **CDN > Properties.**
2. Select the **property name** that you want to deploy the Enforcer on.
3. Select **New Version.**
4. Add [**Property Variables**](#property-variables) and [**Property Configuration Settings Rules**](#property-configuration-settings-rules) as described below.

#### Property Variables

You can add new property variables by selecting **Property Variables > + Variables.** You must include all these variables.

| **Variable Name**          | **Initial Value**                      | **Description**                                                         | **Security Settings** |
| -------------------------- | -------------------------------------- | ----------------------------------------------------------------------- | --------------------- |
| `PX_APP_ID`                | Your Application ID (e.g., PX12345678) | The HUMAN Security application ID                                       | Visible               |
| `PX_AUTH_TOKEN`            | Your Risk Authentication Token         | The authentication token for the Risk API                               | Hidden                |
| `PX_COOKIE_SECRET`         | Your Cookie Key                        | The hash key for the cookie HMAC                                        | Hidden                |
| `PX_BACKEND_DOMAIN`        | sapi-\<PX\_APP\_ID>.perimeterx.net     | Backend domain used for risk, async and telemetry activities.           | Visible               |
| `PX_CI_EXTRACT_ENABLED`    | false                                  | Whether credentials should be extracted for Credential Intelligence     | Visible               |
| `PX_GRAPHQL_ENABLED`       | true                                   | Whether GraphQL details should be extracted from GraphQL request bodies | Visible               |
| `PX_CLIENT_IP`             |                                        | Leave blank.                                                            | Visible               |
| `PX_REQUEST_ID`            |                                        | Leave blank.                                                            | Visible               |
| `PX_TLS_VERSION`           |                                        | Leave blank.                                                            | Visible               |
| `PX_TLS_CIPHER_NAME`       |                                        | Leave blank.                                                            | Visible               |
| `PX_TLS_PREFERRED_CIPHERS` |                                        | Leave blank.                                                            | Visible               |
| `PX_RP_STATUS`             |                                        | Leave blank.                                                            | Visible               |
| `PX_RP_ERROR`              |                                        | Leave blank.                                                            | Visible               |
| `PX_BACKEND_REQ`           |                                        | Leave blank.                                                            | Visible               |
| `BYPASS_EW_RP_EVENT`       | true                                   | Bypass the responseProvider function (bypassed by default)              | Visible               |
| `BYPASS_EW_CLTREQ_EVENT`   | false                                  | Bypass the onClientRequest function (not bypassed by default)           | Visible               |
| `BYPASS_EW_CLTRESP_EVENT`  | false                                  | Bypass the onClientResponse function (not bypassed by default)          | Visible               |

> **Note**
>
> These are the required Property Manager Variables. For additional configurations, see the [Configurations](#property-configuration-settings-rules) section.

#### Property Configuration Settings Rules

You can add new property rules by selecting **Property Configuration Settings > + Rules.** You must include all the following rules.

Property manager rules should be created in the following hierarchy:

![](/_fern-img/a223d506fe2cbe67884b75d7ab07cb3180beb87b97f5012b94ee08cd64006f24.webp)

* PXEnforcerRule
  * PXSapiRule
  * PXFirstPartyClientRule
  * PXFirstPartyCaptchaRule
  * PXFirstPartyXHRRule
  * PXBlockScriptRule
  * PXRemoveInternalHeadersRule
  * PXResponseProviderRule
    * PXSetCIBypassResponseProviderRule
    * PXSetGraphqlBypassResponseProviderRule
    * PXSetRemoteConfigBypassResponseProviderRule
  * PXWorkerRule
  * PXStaticContentWorkerRule
  * PXResponseRule
    * PXSetResponseProviderErrorRule
    * PXEdgeworkerFailureRule

> **Note**
>
> The instructions below contain placeholder values that must be replaced with your actual values.
>
> * `<app_id>` should be replaced with your HUMAN application ID (e.g., `PX12345678`).
> * `<app_id_without_px>` should be replaced with your HUMAN application ID without the "PX" prefix (e.g., `12345678`).
> * `<netstorage_cp-code>` should be replaced with your Akamai NetStorage CP code.
> * `<edgeworker_id>` should be replaced with your Akamai EdgeWorker ID.

You can learn how to create each rule below. Click each heading to open it.

**PXEnforcerRule**

Parent rule for all HUMAN Security behaviors. To create this rule:

1. Select **+ Rules.**
2. Select the **Blank Rule Template** and enter **PXEnforcerRule** as the rule name.
3. Select **Insert Rule.**
4. Select **Save**.

![](/_fern-img/f6166c8bf1d3f28206c7972668dacda2dcd8352d412d3ffd3c0e6bf5f706127d.webp)

**PXSapiRule**

HUMAN Security rule to handle all internal PX requests. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXSapiRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXSapiRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **+ Match** and add the following 1 criterion:
   * Criterion #1:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /\<app\_id\_without\_px>/sapi\*
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 4 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_BACKEND\_REQ
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #2:
     * **Name**: Origin
     * **Origin Type**: Your Origin
     * **Origin Server Hostname**: `{{user.PMUSER_PX_BACKEND_DOMAIN}}`
     * **Forward Host Header**: Origin Hostname
     * **Cache Key Hostname**: Incoming Host Header
     * **IPv6 Origin Support**: IPv4-Only
     * **Supports Gzip Compression**: Yes
     * **Send True Client IP Header**: Yes
     * **True Client IP Header Name**: True-Client-IP
     * **Allow Clients To Set True Client IP Header**: No
     * **Verification Settings**: Choose Your Own
     * **Use SNI TLS Extension**: Yes
     * **Match CN/SAN To**: `{{Origin Hostname}}`, `{{Forward Host Header}}`
     * **Trust**: Akamai-managed Certificate Authorities Sets
     * **Akamai-managed Certificate Authority Sets**:
       * **Akamai Certificate Store**: Enabled
       * **Third Party Certificate Store**: Disabled
     * **HTTP Port**: 80
     * **HTTPS Port**: 443
   * Behavior #3:
     * **Name**: Modify Outgoing Request Path
     * **Action**: Remove part of the incoming path
     * **Find What**: /\<app\_id\_without\_px>/sapi/
     * **Occurrences**: First occurrence only
     * **Keep The Query Parameters**: Yes
   * Behavior #4:
     * **Name**: Caching
     * **Caching Option**: No store
7. Select **Save**.

![](/_fern-img/4c675be4e7c377af626694d075beadf7ae4c564e188899f53f14879776b227ac.webp)

**PXFirstPartyClientRule**

HUMAN Security rule to handle first party sensor requests. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXFirstPartyClientRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXFirstPartyClientRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **+ Match** and add the following 1 criterion:
   * Criterion #1:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /\<app\_id\_without\_px>/init.js
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 4 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_BACKEND\_REQ
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #2:
     * **Name**: Origin
     * **Origin Type**: Your Origin
     * **Origin Server Hostname**: `{{user.PMUSER_PX_BACKEND_DOMAIN}}`
     * **Forward Host Header**: Origin Hostname
     * **Cache Key Hostname**: Incoming Host Header
     * **IPv6 Origin Support**: IPv4-Only
     * **Supports Gzip Compression**: Yes
     * **Send True Client IP Header**: Yes
     * **True Client IP Header Name**: True-Client-IP
     * **Allow Clients To Set True Client IP Header**: No
     * **Verification Settings**: Choose Your Own
     * **Use SNI TLS Extension**: Yes
     * **Match CN/SAN To**: `{{Origin Hostname}}`, `{{Forward Host Header}}`
     * **Trust**: Akamai-managed Certificate Authorities Sets
     * **Akamai-managed Certificate Authority Sets**:
       * **Akamai Certificate Store**: Enabled
       * **Third Party Certificate Store**: Disabled
     * **HTTP Port**: 80
     * **HTTPS Port**: 443
   * Behavior #3:
     * **Name**: Modify Outgoing Request Header
     * **Action**: Add
     * **Select Header Name**: Other...
     * **Custom Header Name**: X-PX-FIRST-PARTY
     * **Header Value**: 1
   * Behavior #4:
     * **Name**: Modify Outgoing Request Path
     * **Action**: Replace the entire path
     * **Replace With**: /bd/client/`{{user.PMUSER_PX_APP_ID}}`/main.min.js
7. Select **Save**.

![](/_fern-img/f2f0e5cf0bcd96930ff42023203bfeec27e1effc336d206b196c53c05cdf4643.webp)

**PXFirstPartyCaptchaRule**

HUMAN Security rule to handle first party captcha requests. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXFirstPartyCaptchaRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXFirstPartyCaptchaRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **+ Match** and add the following 1 criterion:
   * Criterion #1:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /\<app\_id\_without\_px>/captcha/\*
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 4 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_BACKEND\_REQ
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #2:
     * **Name**: Origin
     * **Origin Type**: Your Origin
     * **Origin Server Hostname**: `{{user.PMUSER_PX_BACKEND_DOMAIN}}`
     * **Forward Host Header**: Origin Hostname
     * **Cache Key Hostname**: Incoming Host Header
     * **IPv6 Origin Support**: IPv4-Only
     * **Supports Gzip Compression**: Yes
     * **Send True Client IP Header**: Yes
     * **True Client IP Header Name**: True-Client-IP
     * **Allow Clients To Set True Client IP Header**: No
     * **Verification Settings**: Choose Your Own
     * **Use SNI TLS Extension**: Yes
     * **Match CN/SAN To**: `{{Origin Hostname}}`, `{{Forward Host Header}}`
     * **Trust**: Akamai-managed Certificate Authorities Sets
     * **Akamai-managed Certificate Authority Sets**:
       * **Akamai Certificate Store**: Enabled
       * **Third Party Certificate Store**: Disabled
     * **HTTP Port**: 80
     * **HTTPS Port**: 443
   * Behavior #3:
     * **Name**: Modify Outgoing Request Header
     * **Action**: Add
     * **Select Header Name**: Other...
     * **Custom Header Name**: X-PX-FIRST-PARTY
     * **Header Value**: 1
   * Behavior #4:
     * **Name**: Modify Outgoing Request Path
     * **Action**: Replace part of the incoming path
     * **Find What**: /\<app\_id\_without\_px>/captcha/
     * **Replace With**: /bd/captcha/\<app\_id>/
     * **Occurrences**: First occurrence only
     * **Keep The Query Parameters**: Yes
7. Select **Save**.

![](/_fern-img/242b90ad979359c1d0f55ac97286dd785acb3c8931804d4bfd9398342aa83346.webp)

**PXFirstPartyXHRRule**

HUMAN Security rule to handle first party XHR requests. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXFirstPartyXHRRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXFirstPartyXHRRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **+ Match** and add the following 1 criterion:
   * Criterion #1:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /\<app\_id\_without\_px>/xhr/\*
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 6 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_BACKEND\_REQ
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #2:
     * **Name**: Origin
     * **Origin Type**: Your Origin
     * **Origin Server Hostname**: `{{user.PMUSER_PX_BACKEND_DOMAIN}}`
     * **Forward Host Header**: Origin Hostname
     * **Cache Key Hostname**: Incoming Host Header
     * **IPv6 Origin Support**: IPv4-Only
     * **Supports Gzip Compression**: Yes
     * **Send True Client IP Header**: Yes
     * **True Client IP Header Name**: True-Client-IP
     * **Allow Clients To Set True Client IP Header**: No
     * **Verification Settings**: Choose Your Own
     * **Use SNI TLS Extension**: Yes
     * **Match CN/SAN To**: `{{Origin Hostname}}`, `{{Forward Host Header}}`
     * **Trust**: Akamai-managed Certificate Authorities Sets
     * **Akamai-managed Certificate Authority Sets**:
       * **Akamai Certificate Store**: Enabled
       * **Third Party Certificate Store**: Disabled
     * **HTTP Port**: 80
     * **HTTPS Port**: 443
   * Behavior #3:
     * **Name**: Modify Outgoing Request Header
     * **Action**: Add
     * **Select Header Name**: Other...
     * **Custom Header Name**: X-PX-FIRST-PARTY
     * **Header Value**: 1
   * Behavior #4:
     * **Name**: Allow POST
     * **Behavior**: Allow
     * **Allow POST Without Content-Length Header**: Deny
   * Behavior #5:
     * **Name**: Modify Outgoing Request Path
     * **Action**: Remove part of the incoming path
     * **Find What**: /\<app\_id\_without\_px>/xhr/
     * **Occurrences**: First occurrence only
     * **Keep The Query Parameters**: Yes
   * Behavior #6:
     * **Name**: Modify Outgoing Request Header
     * **Action**: Add
     * **Select Header Name**: Other...
     * **Custom Header Name**: X-PX-ENFORCER-TRUE-IP
     * **Header Value**: `{{builtin.AK_CLIENT_REAL_IP}}`
7. Select **Save**.

![](/_fern-img/4dd70fe6a52ce8d5a131acfde6204cf946fa503db318733db6da8d08f14e050d.webp)

**PXBlockScriptRule**

HUMAN Security rule for redirecting to NetStorage origin. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXBlockScriptRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXBlockScriptRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: requestMethod
     * **Result**: IS
     * **Value**: GET
   * Criterion #2:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /pxns/\*
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 3 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_BACKEND\_REQ
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #2:
     * **Name**: Origin
     * **Origin Type**: NetStorage
     * **NetStorage Account**: \<netstorage\_cp\_code>
   * Behavior #3:
     * **Name**: Modify Outgoing Request Path
     * **Action**: Replace part of the incoming path
     * **Find What**: /pxns/
     * **Replace With**: /px/
     * **Occurrences**: First occurrence only
     * **Keep The Query Parameters**: Yes
7. Select **Save**.

![](/_fern-img/6a5eeb39b895bd55275ecb99b2bee059ccbfca9615e9e882589f99d1c2e6ef10.webp)

**PXRemoveInternalHeadersRule**

HUMAN Security rule to remove internal Enforcer headers from outgoing requests. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXRemoveInternalHeadersRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXRemoveInternalHeadersRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 2 behaviors:
   * Behavior #1:
     * **Name**: Modify Outgoing Request Header
     * **Action**: Remove
     * **Select Header Name**: Other...
     * **Custom Header Name**: X-PX-CONTEXT
   * Behavior #2:
     * **Name**: Modify Outgoing Request Header
     * **Action**: Remove
     * **Select Header Name**: Other...
     * **Custom Header Name**: X-PX-REMOTE-CONFIG
6. Select **Save**.

![](/_fern-img/efd6e4c90ad928a7ce412dd4b8f71c0314d73b8e4be5a46722d11be1f5b96d8b.webp)

**PXResponseProviderRule**

HUMAN Security rule for setting the bypass response provider variable in cases where the request body needs to be accessed. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXResponseProviderRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXResponseProviderRule** as the rule name.
4. Select **Insert Rule.**
5. Select **Save**.

![](/_fern-img/21da7ce41d14b5ba4d79c23d48619cd4cd6f0e365b3436871045aa9444dc956b.webp)

**PXSetCIBypassResponseProviderRule**

HUMAN Security rule for setting the bypass response provider variable in cases of Credentials Intelligence. To create this rule:

1. Select the **PXResponseProviderRule** you created earlier. This will nest PXSetCIBypassResponseProviderRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXSetCIBypassResponseProviderRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: matchVariable
     * **Result**: IS
     * **Property Variable**: PMUSER\_PX\_CI\_EXTRACT\_ENABLED
     * **Operand**: true
     * **Wildcards in Value**: No
     * **Case-Sensitive Value**: Yes
   * Criterion #2:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /login (any request endpoints used for Credential Intelligence)
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 3 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_RP\_EVENT
     * **Create Value From**: Expression
     * **Expression**: false
     * **Operation**: None
   * Behavior #2:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_CLTREQ\_EVENT
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #3:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_CLTRESP\_EVENT
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
7. Select **Save**.

![](/_fern-img/b05fbc2989313a4f1d8aa1fbf0cc565f41c474300e4061edaac5d81cf254e39e.webp)

**PXSetGraphqlBypassResponseProviderRule**

HUMAN Security rule for setting the bypass response provider variable in cases of GraphQL. To create this rule:

1. Select the **PXResponseProviderRule** you created earlier. This will nest PXSetGraphqlBypassResponseProviderRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXSetGraphqlBypassResponseProviderRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 3 criteria:
   * Criterion #1:
     * **Name**: matchVariable
     * **Result**: IS
     * **Property Variable**: PMUSER\_PX\_GRAPHQL\_ENABLED
     * **Operand**: true
     * **Wildcards in Value**: No
     * **Case-Sensitive Value**: Yes
   * Criterion #2:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /graphql (any request endpoints used for GraphQL)
   * Criterion #3:
     * **Name**: requestMethod
     * **Result**: IS
     * **Value**: POST
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 3 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_RP\_EVENT
     * **Create Value From**: Expression
     * **Expression**: false
     * **Operation**: None
   * Behavior #2:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_CLTREQ\_EVENT
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #3:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_CLTRESP\_EVENT
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
7. Select **Save**.

![](/_fern-img/a3aacedb6e2083c16bf41d215d45512a2b20ef384237dc893f78868715e97340.webp)

**PXSetRemoteConfigBypassResponseProviderRule**

HUMAN Security rule for setting the bypass response provider variable in cases of remote config. To create this rule:

1. Select the **PXResponseProviderRule** you created earlier. This will nest PXSetRemoteConfigBypassResponseProviderRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXSetRemoteConfigBypassResponseProviderRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: path
     * **Result**: MATCHES\_ONE\_OF
     * **URL**: /\<app\_id\_without\_px>/notify
   * Criterion #2:
     * **Name**: requestMethod
     * **Result**: IS
     * **Value**: POST
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 3 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_RP\_EVENT
     * **Create Value From**: Expression
     * **Expression**: false
     * **Operation**: None
   * Behavior #2:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_CLTREQ\_EVENT
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
   * Behavior #3:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_BYPASS\_EW\_CLTRESP\_EVENT
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
7. Select **Save**.

![](/_fern-img/5e05fde189d5da4fe9ed67918654494634070c17217e5673481a02ad8e856ad6.webp)

**PXWorkerRule**

Invokes PerimeterX Edgeworker. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXWorkerRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXWorkerRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: matchVariable
     * **Result**: IS\_NOT
     * **Property Variable**: PMUSER\_PX\_BACKEND\_REQ
     * **Operand**: true
     * **Wildcards in Value**: No
     * **Case-Sensitive Value**: Yes
   * Criterion #2:
     * **Name**: fileExtension
     * **Result**: IS\_NOT\_ONE\_OF
     * **Values**: css, bmp, tif, ttf, docx, woff2, js, pict, tiff, eot, xlsx, jpg, csv, eps, woff, xls, jpeg, doc, ejs, otf, pptx, gif, pdf, swf, svg, ps, ico, pls, midi, svgz, class, png, ppt, mid, webp, jar, json, xml
     * **Case-Sensitive**: No
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 6 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_CLIENT\_IP
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_CLIENT_REAL_IP}}`
     * **Operation**: None
   * Behavior #2:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_REQUEST\_ID
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_REFERENCE_ID}}`
     * **Operation**: None
   * Behavior #3:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_TLS\_VERSION
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_TLS_VERSION}}`
     * **Operation**: None
   * Behavior #4:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_TLS\_CIPHER\_NAME
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_TLS_CIPHER_NAME}}`
     * **Operation**: None
   * Behavior #5:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_TLS\_PREFERRED\_CIPHERS
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_TLS_PREFERRED_CIPHERS}}`
     * **Operation**: None
   * Behavior #6:
     * **Name**: EdgeWorkers
     * **Enable**: On
     * **Identifier**: \<edgeworker\_id> (Tier 200)
     * **Enable MPulse Reports**: Off
7. Select **Save**.

![](/_fern-img/3c7fa8a7fe4d0e4a11d9d8a7d2500aaf98e162e4c8ed7e9a095fde9ea1685d9c.webp)

**PXStaticContentWorkerRule**

HUMAN Security rule for non-GET static file requests. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXStaticContentWorkerRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXStaticContentWorkerRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: fileExtension
     * **Result**: IS\_ONE\_OF
     * **Values**: css, bmp, tif, ttf, docx, woff2, js, pict, tiff, eot, xlsx, jpg, csv, eps, woff, xls, jpeg, doc, ejs, otf, pptx, gif, pdf, swf, svg, ps, ico, pls, midi, svgz, class, png, ppt, mid, webp, jar, json, xml
     * **Case-Sensitive**: No
   * Criterion #2:
     * **Name**: requestMethod
     * **Result**: IS\_NOT
     * **Value**: GET
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 6 behaviors:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_CLIENT\_IP
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_CLIENT_REAL_IP}}`
     * **Operation**: None
   * Behavior #2:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_REQUEST\_ID
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_REFERENCE_ID}}`
     * **Operation**: None
   * Behavior #3:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_TLS\_VERSION
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_TLS_VERSION}}`
     * **Operation**: None
   * Behavior #4:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_TLS\_CIPHER\_NAME
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_TLS_CIPHER_NAME}}`
     * **Operation**: None
   * Behavior #5:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_TLS\_PREFERRED\_CIPHERS
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_TLS_PREFERRED_CIPHERS}}`
     * **Operation**: None
   * Behavior #6:
     * **Name**: EdgeWorkers
     * **Enable**: On
     * **Identifier**: \<edgeworker\_id> (Tier 200)
     * **Enable MPulse Reports**: Off
7. Select **Save**.

![](/_fern-img/fe8c071c01e0e2cda294efb63aa5089de57a9d7f965b626824b08634d9779ff7.webp)

**PXResponseRule**

HUMAN Security rule for HTTP responses. To create this rule:

1. Select the **PXEnforcerRule** you created earlier. This will nest PXResponseRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXResponseRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **+ Match** and add the following 1 criterion:
   * Criterion #1:
     * **Name**: metadataStage
     * **Operator**: IS
     * **Value**: client-response
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 1 behavior:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_RP\_STATUS
     * **Create Value From**: Expression
     * **Expression**: `{{builtin.AK_EDGEWORKERS_RP_STATUS}}`
     * **Operation**: None
7. Select **Save**.

![](/_fern-img/a763fc81004be85200f9f395431b23c0882b3b938103430c8cf4073178138af9.webp)

**PXSetResponseProviderErrorRule**

HUMAN Security rule for setting the response provider error variable. To create this rule:

1. Select the **PXResponseRule** you created earlier. This will nest PXSetResponseProviderErrorRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXSetResponseProviderErrorRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match All** so that all the criteria must be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: matchVariable
     * **Result**: IS\_NOT\_EMPTY
     * **Property Variable**: PMUSER\_PX\_RP\_STATUS
   * Criterion #2:
     * **Name**: matchVariable
     * **Result**: IS\_NOT\_ONE\_OF
     * **Property Variable**: PMUSER\_PX\_RP\_STATUS
     * **Variable Values**: *success*, *unimplementedHandler*
     * **Wildcards in Value**: Yes
     * **Case-Sensitive Value**: No
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 1 behavior:
   * Behavior #1:
     * **Name**: Set Variable
     * **Variable Name**: PMUSER\_PX\_RP\_ERROR
     * **Create Value From**: Expression
     * **Expression**: true
     * **Operation**: None
7. Select **Save**.

![](/_fern-img/9d9c34da88cdfce5d5040082976dcd38459ba4c0ef65be87d1f37d851cc49d63.webp)

**PXEdgeworkerFailureRule**

HUMAN Security rule for handling edgeworker failures. To create this rule:

1. Select the **PXResponseRule** you created earlier. This will nest PXEdgeworkerFailureRule inside when you create it.
2. Select **+ Rules.**
3. Select the **Blank Rule Template** and enter **PXEdgeworkerFailureRule** as the rule name.
4. Select **Insert Rule.**
5. In the **Criteria** section, select **Match Any** so that any of the criteria may be met to trigger the behaviors. Select **+ Match** and add the following 2 criteria:
   * Criterion #1:
     * **Name**: edgeWorkersFailure
     * **Status**: FAILURE
   * Criterion #2:
     * **Name**: matchVariable
     * **Result**: IS
     * **Property Variable**: PMUSER\_PX\_RP\_ERROR
     * **Operand**: true
     * **Wildcards in Value**: No
     * **Case-Sensitive Value**: Yes
6. In the **Behaviors** section, select **+ Behavior > Standard Property Behavior** and create the following 1 behavior:
   * Behavior #1:
     * **Name**: Site Failover
     * **Enable**: On
     * **Action**: Use alternate hostname in this property
     * **Alternate Hostname In This Property**: `{{builtin.AK_HOST}}`
     * **Modify Request Path**: No
7. Select **Save**.

![](/_fern-img/f3e042c54d7d3ffb2cfa8fb8c86c088ce80982d5dc5f5232e8264354e028276a.webp)

#### Wrap up

Once you create all the necessary variables and rules, you’re ready to activate the Enforcer.

1. From the editor, select **Save**.
2. Navigate to the **Activate** tab.
3. Choose the network you would like to activate on and select **Activate**. We recommend activating on your **Staging** network first for testing purposes.
4. If you chose to deploy to Staging, then confirm that the Enforcer is working properly and **Activate on Production.**

Your Akamai Enforcer has been successfully installed with the minimum requirements to monitor activity on your CDN. You can further customize the Enforcer’s behavior by referencing our [configuration options.](/applications/akamai-edgeworker-enforcer-configuration)

Once you finish installing, be sure to contact HUMAN to complete your tuning process.