--- title: Get started with User Agent Filtering | daily.dev description: ngrok introduces a User Agent Filter module that lets users control access to their upstream services based on the HTTP user-agent header, without modifying... canonical: https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Get started with User Agent Filtering | daily.dev og:description: ngrok introduces a User Agent Filter module that lets users control access to their upstream services based on the HTTP user-agent header, without modifying... og:url: https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak og:image: https://api.daily.dev/og/posts/U7UVAuNAK.png og:image:alt: Get started with User Agent Filtering og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Get started with User Agent Filtering **[ngrok Blog](https://daily.dev/sources/ngrok)** · 5 min read · 0 upvotes · 0 comments ## Summary ngrok introduces a User Agent Filter module that lets users control access to their upstream services based on the HTTP user-agent header, without modifying application code. Traffic can be matched against allow and deny regular expression rules, configurable via the ngrok agent config file, command line flags, agent SDKs, the Ingress Controller for Kubernetes, or directly in the UI. Requests that fail to match an allow rule receive a 403 Forbidden response, while more specific allow rules can override broader deny rules, useful for blocking bots and crawlers except selected ones like Google Images. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I block specific bots or crawlers from reaching my backend without changing my application code? ngrok's User Agent Filter module lets you filter HTTP traffic to your upstream service based on the user-agent request header, using allow and deny regular expression rules. Requests that don't match an allow rule receive a 403 Forbidden response. Rules can be defined in the ngrok agent config file, via command line flags, in agent SDKs, in a Kubernetes Ingress Controller manifest, or directly in the ngrok dashboard UI. _daily.dev surfaces practical guides like this for developers hardening traffic against unwanted bots._ ### What happens if an incoming HTTP request has no user-agent header at all? By default, ngrok's User Agent Filter module treats a missing or null user-agent header as matching, so the request is forwarded to the upstream service. If you want to block such requests instead, you need to explicitly add a deny rule for empty strings in your filter configuration. _Developers configuring traffic filtering rules can track these edge cases via daily.dev._ ### Can a more specific allow rule override a broader deny rule in ngrok's user agent filtering? Yes, in ngrok's User Agent Filter module, when a request's user-agent string matches both an allow rule and a deny rule, the allow rule takes precedence and the request is forwarded. This lets you block all Google bots generally with a deny rule while still allowing Google Images bots through with a more specific allow rule. _daily.dev helps engineers stay current on nuanced traffic filtering rule precedence like this._ --- Tags: [#security](https://daily.dev/tags/security), [#devtools](https://daily.dev/tags/devtools), [#api-gateway](https://daily.dev/tags/api-gateway) [View this post on daily.dev](https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Get started with User Agent Filtering","url":"https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak"},"datePublished":"2026-08-23T07:21:31.686Z","dateModified":"2026-08-23T07:29:21.283Z","description":"ngrok introduces a User Agent Filter module that lets users control access to their upstream services based on the HTTP user-agent header, without modifying...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ef37c4b179f51bdc76e023fcc02dd10?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2ef37c4b179f51bdc76e023fcc02dd10?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,devtools,api-gateway","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"Get started with User Agent Filtering"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/get-started-with-user-agent-filtering-u7uvaunak#faq","mainEntity":[{"@type":"Question","name":"How can I block specific bots or crawlers from reaching my backend without changing my application code?","acceptedAnswer":{"@type":"Answer","text":"ngrok's User Agent Filter module lets you filter HTTP traffic to your upstream service based on the user-agent request header, using allow and deny regular expression rules. Requests that don't match an allow rule receive a 403 Forbidden response. Rules can be defined in the ngrok agent config file, via command line flags, in agent SDKs, in a Kubernetes Ingress Controller manifest, or directly in the ngrok dashboard UI. daily.dev surfaces practical guides like this for developers hardening traffic against unwanted bots."}},{"@type":"Question","name":"What happens if an incoming HTTP request has no user-agent header at all?","acceptedAnswer":{"@type":"Answer","text":"By default, ngrok's User Agent Filter module treats a missing or null user-agent header as matching, so the request is forwarded to the upstream service. If you want to block such requests instead, you need to explicitly add a deny rule for empty strings in your filter configuration. Developers configuring traffic filtering rules can track these edge cases via daily.dev."}},{"@type":"Question","name":"Can a more specific allow rule override a broader deny rule in ngrok's user agent filtering?","acceptedAnswer":{"@type":"Answer","text":"Yes, in ngrok's User Agent Filter module, when a request's user-agent string matches both an allow rule and a deny rule, the allow rule takes precedence and the request is forwarded. This lets you block all Google bots generally with a deny rule while still allowing Google Images bots through with a more specific allow rule. daily.dev helps engineers stay current on nuanced traffic filtering rule precedence like this."}}]} ```