Citadel challenge levels explained

Choose the right level

• Start public websites on Auto (Balanced). It begins at a calmer baseline and escalates under attack.
• Use Interaction during active abuse when Auto is insufficient, and allowlist APIs first.
• Use Lockdown only for emergencies; pair it with specific IP or path allowlists for administrators and integrations.
• Off can suit a private app already gated elsewhere; proxy logs and configured rate limits still apply.

Cookie and JS are lighter browser checks between Off and Interaction.

Recovery behavior

After a proxy restart, Auto heals an elevated level to its calm baseline. Fixed saved levels, including Interaction, remain as configured. Higher friction can interrupt APIs and headless monitors without allowlists.