security

The security commands show and change the security settings of an environment: how HTTPS is forced, bot protection, the list of denied IP addresses and the redirect rules.

kinstactl security force-https my-site --env live
kinstactl security bot-protection level my-site challenge-bots --env live
kinstactl security redirects add my-site /old /new --env live

Without --env, a site with one environment uses it; a site with several gets a picker on a terminal and fails with ENV_REQUIRED in a script. See Sites and environments. Commands that change something accept --dry-run, which prints the request and sends nothing; a dry run needs no confirmation. Commands marked below as asking for confirmation prompt on a terminal; in a script pass --yes, otherwise they fail with CONFIRMATION_REQUIRED (exit code 5).

--no-wait and --timeout <minutes> exist on force-https, on the three bot-protection settings and on bot-protection exceptions add and delete; see operations. The denied-ips and redirects commands have neither flag.

security force-https

Show or change how an environment forces HTTPS.

kinstactl security force-https my-site primary --env live

kinstactl security force-https <site> [mode] [options]

Show or change how an environment forces HTTPS (all, primary, off)

Arguments

Argument	Description
site	site name, display name or ID
mode	all: redirect every domain, primary: redirect to the primary domain, off: do not force HTTPS Choices: all, primary, off.

Options

Option	Description
--env <environment>	environment name or ID
--dry-run	print the resolved target and request; change nothing
--no-wait	return the operation ID instead of waiting
--timeout <minutes>	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/force-https-status, POST /sites/environments/{env_id}/force-https-status

Without a mode the command prints the current one. The mode is one of all (redirect every domain to HTTPS), primary (redirect to the primary domain) or off (do not force HTTPS). Changing it asks for no confirmation and waits for Kinsta to finish.

security bot-protection level

Show or set the bot protection level.

kinstactl security bot-protection level my-site challenge-bots --env live

kinstactl security bot-protection level <site> [value] [options]

Show or set the bot protection level of an environment

Arguments

Argument	Description
site	site name, display name or ID
value	new value; omit to show the current one Choices: block-malicious-traffic, block-automations, challenge-bots, challenge-everyone.

Options

Option	Description
--env <environment>	environment name or ID
--dry-run	print the resolved target and request; change nothing
--no-wait	return the operation ID instead of waiting
--timeout <minutes>	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/bot-protection/level, PUT /sites/environments/{env_id}/bot-protection/level

Without a value the command prints the current level, or (not configured) when the environment has no bot protection. The level is one of block-malicious-traffic, block-automations, challenge-bots or challenge-everyone. Setting it asks for no confirmation.

security bot-protection ai-crawlers

Show or set whether AI crawlers are blocked.

kinstactl security bot-protection ai-crawlers my-site block --env live

kinstactl security bot-protection ai-crawlers <site> [value] [options]

Show or set whether AI crawlers are blocked

Arguments

Argument	Description
site	site name, display name or ID
value	new value; omit to show the current one Choices: block, allow.

Options

Option	Description
--env <environment>	environment name or ID
--dry-run	print the resolved target and request; change nothing
--no-wait	return the operation ID instead of waiting
--timeout <minutes>	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/bot-protection/ai-crawlers, PUT /sites/environments/{env_id}/bot-protection/ai-crawlers

The value is block or allow. Without a value the command prints the current one, or (not configured).

security bot-protection wp-automations

Show or set whether WordPress automations are allowed.

kinstactl security bot-protection wp-automations my-site allow --env live

kinstactl security bot-protection wp-automations <site> [value] [options]

Show or set whether WordPress automations are allowed

Arguments

Argument	Description
site	site name, display name or ID
value	new value; omit to show the current one Choices: allow, block.

Options

Option	Description
--env <environment>	environment name or ID
--dry-run	print the resolved target and request; change nothing
--no-wait	return the operation ID instead of waiting
--timeout <minutes>	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/bot-protection/wp-automations, PUT /sites/environments/{env_id}/bot-protection/wp-automations

The value is allow or block. Without a value the command prints the current one, or (not configured).

security bot-protection exceptions list

List the bot protection exception rules.

kinstactl security bot-protection exceptions list my-site --env live

kinstactl security bot-protection exceptions list [site] [options]

List the bot protection exception rules of an environment

Arguments

Argument	Description
site	site name, display name or ID

Options

Option	Description
--env <environment>	environment name or ID

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/bot-protection/exception-rules

The table shows the ID, type, action and value of each rule. When the environment also has custom WAF rules, the command adds a line about that on stderr. The ID is what exceptions delete expects, and has the form type:action:value, for example ip:skip:192.0.2.1.

security bot-protection exceptions add

Add a bot protection exception rule.

kinstactl security bot-protection exceptions add my-site ip skip 192.0.2.1 --env live

kinstactl security bot-protection exceptions add <site> <type> <action> <value> [options]

Add a bot protection exception rule

Arguments

Argument	Description
site	site name, display name or ID
type	what the rule matches on Choices: ip, path, user_agent, country.
action	what to do with matching traffic Choices: skip, challenge, block.
value	the value to match, e.g. an IP address

Options

Option	Description
--env <environment>	environment name or ID
--dry-run	print the resolved target and request; change nothing
--no-wait	return the operation ID instead of waiting
--timeout <minutes>	give up waiting after this many minutes (default 30)

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/bot-protection/exception-rules

A rule has a type (ip, path, user_agent or country), an action (skip, challenge or block) and the value to match, such as an IP address or a country code. Adding needs no confirmation.

security bot-protection exceptions delete

Delete a bot protection exception rule.

kinstactl security bot-protection exceptions delete my-site ip:skip:192.0.2.1 --env live --yes

kinstactl security bot-protection exceptions delete <site> <rule-id> [options]

Delete a bot protection exception rule

Arguments

Argument	Description
site	site name, display name or ID
rule-id	rule ID, see: security bot-protection exceptions list

Options

Option	Description
--env <environment>	environment name or ID
--dry-run	print the resolved target and request; change nothing
--no-wait	return the operation ID instead of waiting
--timeout <minutes>	give up waiting after this many minutes (default 30)
--yes	skip the confirmation prompt

Global options --profile, --json and --no-input apply too. See scripting and CI.

Caution

Asks for confirmation on a TTY. Pass --yes to skip it; without a TTY and without --yes the command fails.

Kinsta API: GET /sites, DELETE /sites/environments/{env_id}/bot-protection/exception-rules

The rule is identified by its ID, as shown by exceptions list. The command asks for confirmation; in a script pass --yes.

security denied-ips

Show or change the denied IP addresses of an environment.

kinstactl security denied-ips my-site --env live

kinstactl security denied-ips [site] [options]

Show or change the denied IPs of an environment

Arguments

Argument	Description
site	site name, display name or ID

Options

Option	Description
--env <environment>	environment name or ID
--add <ip...>	IP addresses to deny
--remove <ip...>	IP addresses to allow again
--clear	remove every denied IP
--dry-run	print the resolved target and request; change nothing
--yes	skip the confirmation prompt

Global options --profile, --json and --no-input apply too. See scripting and CI.

Caution

Asks for confirmation on a TTY. Pass --yes to skip it; without a TTY and without --yes the command fails.

Kinsta API: GET /sites, GET /sites/tools/denied-ips, PUT /sites/tools/denied-ips

Without --add, --remove or --clear the command prints the current list, one address per line. --add and --remove take one or more addresses; --clear empties the list:

kinstactl security denied-ips my-site --env live --add 203.0.113.7 --yes
kinstactl security denied-ips my-site --env live --remove 203.0.113.7 203.0.113.8 --yes
kinstactl security denied-ips my-site --env live --clear --yes

Kinsta only accepts the complete list, so the command reads the current list, applies your change and sends the result, replacing the whole list. Every change therefore asks for confirmation; in a script pass --yes. The command fails with a USAGE error if you add an address that is already present, repeat one in --add, give the same address to --add and --remove, remove an address that is not in the list, or combine --clear with --add or --remove.

security redirects list

List the redirect rules of an environment.

kinstactl security redirects list my-site --env live --search /blog --sort from --desc

kinstactl security redirects list [site] [options]

List the redirect rules of an environment

Arguments

Argument	Description
site	site name, display name or ID

Options

Option	Description
--env <environment>	environment name or ID
--limit <n>	number of rules to show
--offset <n>	number of rules to skip
--search <text>	only rules matching this text
--regex	treat --search as a regex
--sort <key>	sort by domain, from, to, type
--desc	sort descending

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/redirect-rules

The table shows the from path, the target, the type and the domain ((all) for a rule that applies to every domain). The command shows 10 rules by default; page through the rest with --limit and --offset. A line such as 10 of 42 rules goes to stderr. --search keeps rules matching a text, or a regular expression with --regex. --sort takes domain, from, to or type, and --desc reverses the order.

security redirects add

Add a redirect rule.

kinstactl security redirects add my-site /old /new --env live

kinstactl security redirects add <site> <from> <to> [options]

Add a redirect rule

Arguments

Argument	Description
site	site name, display name or ID
from	path to redirect from
to	path or URL to redirect to

Options

Option	Description
--env <environment>	environment name or ID
--type <type>	permanent (301) or redirect (302)
--domain <domain>	only redirect this domain (default: all domains)
--dry-run	print the resolved target and request; change nothing

Global options --profile, --json and --no-input apply too. See scripting and CI.

Kinsta API: GET /sites, POST /sites/environments/{env_id}/redirect-rules

The rule redirects the path from to a path or URL to. --type is permanent (301, the default) or redirect (302). Without --domain the rule applies to every domain. Adding needs no confirmation.

kinstactl security redirects add my-site /old https://example.com/new --env live --type redirect --domain example.com

security redirects update

Change a redirect rule.

kinstactl security redirects update my-site /old --env live --to /newer --yes

kinstactl security redirects update <site> <from> [options]

Change a redirect rule

Arguments

Argument	Description
site	site name, display name or ID
from	the from path of the rule to change

Options

Option	Description
--env <environment>	environment name or ID
--to <to>	new target path or URL
--type <type>	new type: permanent (301) or redirect (302)
--domain <domain>	select the rule of this domain when several share from
--new-domain <domain>	move the rule to this domain
--dry-run	print the resolved target and request; change nothing
--yes	skip the confirmation prompt

Global options --profile, --json and --no-input apply too. See scripting and CI.

Caution

Asks for confirmation on a TTY. Pass --yes to skip it; without a TTY and without --yes the command fails.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/redirect-rules, POST /sites/environments/{env_id}/redirect-rules

The rule is found by its from path. Pass at least one of --to, --type or --new-domain, otherwise the command fails with a USAGE error. When several rules share the same from path, the command fails and lists their domains; pick one with --domain. Updating asks for confirmation; in a script pass --yes.

security redirects delete

Delete a redirect rule, or all of them.

kinstactl security redirects delete my-site /old --env live --yes

kinstactl security redirects delete <site> [from] [options]

Delete a redirect rule, or all of them

Arguments

Argument	Description
site	site name, display name or ID
from	the from path of the rule to delete

Options

Option	Description
--env <environment>	environment name or ID
--domain <domain>	select the rule of this domain when several share from
--all	delete every redirect rule
--dry-run	print the resolved target and request; change nothing
--yes	skip the confirmation prompt

Global options --profile, --json and --no-input apply too. See scripting and CI.

Caution

Asks for confirmation on a TTY. Pass --yes to skip it; without a TTY and without --yes the command fails.

Kinsta API: GET /sites, GET /sites/environments/{env_id}/redirect-rules, POST /sites/environments/{env_id}/redirect-rules

Pass either the from path of one rule or --all, not both and not neither. --domain picks the rule when several share the from path, and cannot be combined with --all. Deleting asks for confirmation; in a script pass --yes.

kinstactl security redirects delete my-site --env live --all --yes