Controls should be practical before they look extensive
MacroKeeper is organized around the points where incidents actually happen: events, reservations, applications, verification, and lookup APIs. You can start with a narrow protected URL instead of applying heavy controls to the entire site.
For example, during a reservation launch, the reservation-submit URL and SMS verification API can run strict policies while normal information pages stay open. Operators can review block reasons, release timing, and exception targets as policies are adjusted.
Per-URL policy
Protect the paths that actually receive pressure: event open, reservation submit, application complete, and lookup APIs. Different URLs can use different thresholds, keeping normal browsing open while defending the critical processing points.
POST request protection
Limit repeated submissions on login, verification, signup, payment, and registration APIs. Fast retries, repeated failures, and immediate lookup calls after signup can be treated as suspicious flows.
SMS verification protection
Repeated verification sends create direct cost. MacroKeeper detects repeated send requests by source and behavior pattern, then reduces calls before they reach the SMS provider.
IP blocking and automatic release
Suspicious IPs can be blocked by policy and released automatically after a defined duration. Operators can also release immediately or register exceptions to avoid long-running false positives.
Queue position
Real users receive an ordered waiting position instead of being rejected. Showing the waiting state reduces refresh pressure and lets the service admit traffic at a controlled rate.
Entry token
Only admitted visitors receive a short-lived entry token. Direct repeated calls to protected URLs without a valid token are prevented from bypassing the queue.
Exceptions
Admins, internal networks, payment callbacks, and monitoring servers can be separated from normal visitor rules. This prevents essential operations from being blocked during a strict event policy.
Automation-tool detection
Identify non-browser clients such as curl, wget, Python, axios, and Postman. MacroKeeper combines URL, interval, and repetition data to create usable block candidates.
Operational logs and reports
Review which IP, URL, and rule produced each action. After an event, operators can compare repeated-request reduction and improve the next policy set.
Rollout order
Start with the URL that actually causes pressure, not every feature at once.
Once the target URL, peak timing, and repeated request pattern are clear, it is easier to decide whether Shield, Queue, or both should be applied first.