Skip to main content
A policy template is a complete, pre-built policy: a named set of rules tuned for a specific attack pattern. Instead of authoring conditions yourself, you browse the library, enable the templates that fit your use case, and they go live. Tracenow ships 22 templates grouped across the three threats it protects. Templates are the fastest way to onboard. You can always edit a template’s rules afterward, or add your own from scratch. See Rules for the manual path.
The policy template library grouped by threat, with enable toggles

Policy template library in the dashboard

📸 Screenshot to add: the template library under Guard, showing the three threat groups and the per-template enable toggles.

​
How to enable a template

1

Connect Cloudflare first

Templates evaluate the signals collected by the Cloudflare integration. Connect and deploy the Worker before enabling them.
2

Browse the library

In the dashboard under Guard, open the template library and find the threat you want to cover.
3

Enable in Monitor mode

Turn on the templates you want. Start in Monitor so they observe and log without blocking. Let real traffic flow for a day or two and review the verdicts in the event feed.
4

Switch to Enforce

Once the verdicts look right for your traffic, flip the templates (or specific rules) to Enforce. Now deny verdicts are enforced at the edge.
Some templates use device signals (headless detection, device reuse, timezone mismatch). These work automatically once the Cloudflare Worker is deployed, because the Worker injects the fingerprint script for you. No extra setup is required.

​
The library

Each template’s name tells you its action: templates named Block issue a deny verdict, templates named Challenge issue a challenge. See Verdicts for how to handle each.

​
Fake accounts

Protects the signup event. See the Fake accounts use case.

​
Account takeover

Protects the login event. See the Account takeover use case.
The new-country, new-device, brute-force, and impossible-travel templates are most accurate when they can tie the event to a real account. Add the server-side call with subject_user_id to unlock their full fidelity.

​
SMS pumping

Protects the otp event. See the SMS pumping use case.

​
Templates or custom rules?

Most teams start with templates in Monitor, then add a custom rule or two for their own edge cases. See Rules to author your own.

​
Next steps

Fake accounts

Enable the signup templates.

Account takeover

Enable the login templates, then add the in-app call.

SMS pumping

Enable the OTP templates.