> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.humansecurity.com/_mcp/server.

# Installing the Enforcer

### Prerequisites

In order to enable the HUMAN support on your Fastly service, the HUMAN Fastly Enforcer requires advanced functionality from Fastly.

Send the following e-mail to [support@fastly.com](mailto:support@fastly.com):

* **Subject**: “*Please enable HUMAN support for our Fastly service ID* ”
* **Body**: Please enable HUMAN support for our service ID and confirm when it is completed.

Once Fastly enables HUMAN support, the following pragmas should be enabled at your service:

**fix\_unsent\_body\_drain** - pragma that can be used in VCL to resolve an issue with HTTP response bodies not being fully sent to the client.

**no\_body\_if\_bereq\_is\_get\_or\_head** - pragma that can be used in VCL to prevent a response body from being sent to the client if the request method is GET or HEAD.

You must request to enable functionality for each service ID that is being protected by Bot Defender. If this functionality is not enabled, requests will fail with a "503 service unavailable" error.

> **TEST**
>
> To check that the required pragmas are enabled, open the VCL file and look for the following lines at the pragmas section at the top of the file:
>
> pragma optional\_param fix\_unsent\_body\_drain true;
>
> pragma optional\_param no\_body\_if\_bereq\_is\_get\_or\_head true;
>
> If **fix\_unsent\_body\_drain** and **no\_body\_if\_bereq\_is\_get\_or\_head** pragmas are not there - HUMAN isn’t enabled at your service.

### Setting the Binary Block Result Cookie

In order to use Fastly integration, a binary block result cookie must be defined in the HUMAN Portal:

1. Go to **Admin** > **Policies**, and select the policy.
2. In the *Risk Cookie* tab, select **Advanced Mode**, and click **Continue** in the pop-up.
3. Select the *Cookie Version* (V2), set the *Binary Score/Threshold Score* (100), and the *Validity* as appropriate.
4. Click **Apply**.

> **Note**
>
> Automatic installation of the Fastly enforcer will be available soon on HUMAN portal. This will be supported from Fastly v8.0.0 and above.

#### Manual installation

![](https://fdr-prod-docs-files-public.s3.us-east-1.amazonaws.com/humansecurity.docs.buildwithfern.com/e63dcd6046b3951cd24725f7cc4d290b12dddf815fcf40b4bf6bc04a6832d624/docs/assets/images/d0c651dfd26b12595201003b50881fc7e01ea348d9490c680e84ffc05572b453-2.png?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=AKIA6KXJSKKNFOCF7G4B%2F20260926%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260926T025503Z&X-Amz-Expires=604800&X-Amz-Signature=097ee031484c16804b85ee50311d11c40b726757222cbc2adcc5fc48d9620c53&X-Amz-SignedHeaders=host&x-amz-checksum-mode=ENABLED&x-id=GetObject)

### Customize Custom VCL Files and snippets

Your current VCL Files and snippets must be reviewed by a HUMAN Solution Architect.\
Contact your HUMAN Solution Architect or [HUMAN Support](mailto:socsupport@humansecurity.com) for more information.

### Logging

To report on requests for detection, the Enforcer logs each request and sends it to HUMAN. The following[https loggers](https://docs.fastly.com/en/guides/log-streaming-https)must be configured to enable this functionality:[](/applications/installing-the-enforcer-fastly#logging)

* **PX-Async-Activities** - To send async activities like Page requested, Block, etc to HUMAN's servers.\
  Use the following settings to define your logger:
  * **Name**: PX-Async-Activities
  * **URL**: [https://fastly-async.perimeterx.com/api/v1/collector/s2s](https://fastly-async.perimeterx.com/api/v1/collector/s2s)
  * **Placement**: none
  * \*\*Advanced options\
    \*\*
    * **Content type -** application/json
    * **JSON log entry format** - Array of JSON
  * **All other fields**: No change is needed, use the default values.
* **PX-Telemetry** - This will enable Telemetry feature which can send data about the enforcer configuration to Human Security.\
  Use the following settings to define your logger:
  * **Name**: PX-Telemetry
  * **URL**: [https://fastly-async.perimeterx.com/api/v2/risk/telemetry](https://fastly-async.perimeterx.com/api/v2/risk/telemetry)
  * **Placement**: none
  * **Maximum Logs:** 1
  * \*\*Advanced options\
    \*\*
    * **Content type -** application/json
  * **All other fields**: No change is needed, use the default values.

#### Adding the Loggers[](/applications/installing-the-enforcer-fastly#adding-a-syslog)

**Fastly Web Interface:**\
Add https log endpoints - [log-streaming-https](https://docs.fastly.com/en/guides/log-streaming-https)

**Fastly API:**\
Add https log endpoints - [create-log-https](https://developer.fastly.com/reference/api/logging/https/#create-log-https)\
Use the following Jsons:

```json
{
  "content_type": "application/json",
  "json_format": "1",
  "name": "PX-Async-Activities",
  "placement": "none",
  "url": "https://fastly-async.perimeterx.com/api/v1/collector/s2s"
}
```

```json
{
  "content_type": "application/json",
  "json_format": "0",
  "name": "PX-Telemetry",
  "placement": "none",
  "url": "https://fastly-async.perimeterx.com/api/v2/risk/telemetry",
  "request_max_entries": 1
}
```

### Adding a New WAF Disablement Condition (Optional)

In order to address a potential issue that may arise from running WAF rules multiple times due to an Enforcer restart request, we recommend adding a new condition to the Fastly service. This condition is specifically designed for customers who have enabled Fastly WAF but have not implemented the WAF prefetch condition.

Add the following condition to the Fastly service configuration:

```json
{
    "name": "PX-Waf-Prefetch-Condition",
    "comment": "Condition to prevent duplicate activations of the WAF",
    "priority": "10",
    "type": "PREFETCH",
    "statement": "req.backend.is_origin && !req.http.bypasswaf"
}
```

This condition will effectively prevent the duplication of WAF activations and ensure a smoother operation of the integration.

#### Loggings endpoints (Optional):[](/applications/installing-the-enforcer-fastly#loggings-endpoints-optional)

* **PX-Debug** - Optional debug logging endpoint.\
  Define this endpoint to use `px_logger_severity = "debug"`.
* **PX-Error** - Optional error logging endpoint.\
  Define this endpoint to use `px_logger_severity = "error"`.

To define a logging endpoint - See the [Fastly Logging Documentation](https://docs.fastly.com/guides/streaming-logs/setting-up-remote-log-streaming)

### Uploading the VCL snippets[](/applications/installing-the-enforcer-fastly#uploading-the-vcl-snippets)

For complete Integration of the Enforcer, it is required to add the following snippets to the Fastly service.

* **px\_shield** - VCL snippet to enable Fastly shielding during and after requests validation flow.\
  More on Fastly shielding:\
  [https://docs.fastly.com/en/guides/shielding](https://docs.fastly.com/en/guides/shielding)

```json
{
    "name": "px_shield",
    "dynamic": "0",
    "type": "recv",
    "content": "set var.fastly_req_do_shield = (req.restarts == 0 || (req.restarts == 1 && req.http.X-PX-internal-flow == \"1\"));",
    "priority": "1"
}
```

### Uploading the VCL files

**Basic configuration changes to your VCL are require before uploading the VCL.**

The HUMAN Fastly VCL Enforcer consists of 4 VCL files which need to be uploaded to your service. Select `main.vcl` as the main VCL.\
(This will happen automatically if `main.vcl` is the first VCL uploaded).\
*please note: VCL object names are case sensitive.*

* **`main.vcl`** - **VCL name: "MAIN"** - Default Fastly's VCL, customized with additional code snippets of HUMAN.
* **`PX.vcl`** - **VCL name: "PX"** - Contains all the **internal**HUMAN core logic.
* **`px_configs.vcl`** - **VCL name: "PX\_CONFIGS"** - Contains Enforcer configuration table and additional backends configs.
* **`px_custom.vcl`** - **VCL name: "PX\_CUSTOM"** - Contains Enforcer custom code, defined custom behavior and enforcer features.

> **Modifying MAIN.vcl file**
>
> This file serves solely as an example of how to integrate HUMAN Security subroutine calls into your code.
> HUMAN Security does not edit or modify this file during upgrades.
> HUMAN **subroutine calls must be the first call in each subroutine on MAIN vcl.**

**To upload the VCLs:**

**Fastly Web Interface:**

1. Click **Upload Your First VLC File**.
2. **Name** the VCL file MAIN. This ensures that main.vcl is your main VCL.
3. Upload the corresponding VCL file.
4. Click **Create**.
5. Click **+Upload a New VCL File**, and repeat the process for the remaining three VCL files, naming the files according to the list above.

**Fastly Web Interface:**\
Please review: [vcl-services](https://developer.fastly.com/reference/api/vcl-services/vcl/)

Fastly allows you to create your own VCL files with specialized configurations.\
By default, the ability to upload custom VCL code is disabled when you sign up.\
Contact [support@fastly.com](mailto:support@fastly.com) to upload your custom VCL code.

After completing configure the Enforcer visit [Configuration Options](/applications/) section,\
upload the finalized HUMAN VCL files, according to the [Fastly documentation](https://docs.fastly.com/guides/vcl/uploading-custom-vcl) for uploading custom VCLs, **including last section for multiple VCLs**

> **Note**
>
> You must activate your service version after every change performed to the VCL.

### Error Codes

> **Error codes**
>
> HUMAN Enforcer uses its own VCL error codes.
> The following Error codes should remain unused by other VCL applications.
> Using any of the following codes in other applications may lead to unexpected behavior.
>
> * **991**`first_party_disabled`
> * **992**`first_party_xhr_disabled`
> * **995**`exceeded_rate_limit`, `s2s_high_score`, `cookie_high_score`
> * **996**`cookie_high_score`