All Products
Search
Document Center

Edge Security Acceleration:Rules

Last Updated:Jun 03, 2026

ESA rules let you define conditions that control when specific feature configurations take effect.

Use rules to apply configurations for specific needs such as request transformation, content redirection, or cache policies. Rules also support fine-grained security and traffic management. All rules share consistent syntax to filter requests by characteristics and apply the matching configuration.

Simple configuration examples

Set edge cache TTL for a specific path

Static resources under /content update monthly. To balance persistence and freshness, set the cache TTL for /content resources on ESA POPs to 30 days.

  1. Configure the request filter condition:

    • Use console controls: image

    • Use the expression editor:

      (http.request.uri.path eq "/content")
  2. Configure the edge cache TTL: image

Redirect requests by region

Redirect requests from the Chinese mainland from example.com to example.com.cn.

  1. Configure the request filter condition:

    • Use console controls: image

    • Use the expression editor:

      (http.host eq "example.com" and ip.geoip.country eq "CN")
  2. Configure the redirect destination URL: image

Rule configuration structure

When a request reaches an ESA node, ESA filters and processes it based on your rule configuration.

image

Every ESA rule configuration includes two parts:

Rule configuration = Rule expression + Action

Configure a rule expression to filter requests and an action to run on matched requests. The expression syntax is consistent across all rule-related features in ESA, so you can reuse configurations across features. Rule expression structure.

Rule Precedence

  • Rule configurations take precedence over global settings: For the same feature, rule settings override global settings. Apply general configurations globally and use rules to customize behavior for specific requests.

    image

    For example, if you set Edge TTL to 12 hours in Global Configuration – Edge Cache TTL and set the TTL for /content resources to 30 days in Rules – Configure Edge Cache TTL, the edge node caches /content resources for 30 days. Resources not under /content use the 12-hour global TTL.

    image
  • Rules higher in the list have higher priority: For the same rule type, ESA executes rules from top to bottom. If a request matches multiple rules, drag the image button to reorder rules by priority.

    Note

    Available features and rule quotas vary by plan. Rule and plan quotas.

    For example, suppose you have two cache rules:

    Rule 1: Resources under the /content path expire after 30 days.
    Rule 2: Files with the .jpg suffix are cached for 60 days.
    • When Rule 1 is above Rule 2:

      image

      Edge node cache TTLs:

      Sample URL

      Under /content path

      .jpg suffix

      Cache expiration time

      https://example.com/content/static/pic.jpg

      p442272.png

      p442272.png

      30 days

      https://example.com/content/static/book.txt

      p442272.png

      ×

      30 days

      https://example.com/static/pic.jpg

      ×

      p442272.png

      60 days

      https://example.com/static/res/book.text

      ×

      ×

      Do not cache

    • When Rule 2 is above Rule 1:image

      Edge node cache TTLs:

      Sample URI

      Under /content path

      .jpg suffix

      Cache expiration time

      https://example.com/content/static/pic.jpg

      p442272.png

      p442272.png

      60 days

      https://example.com/content/static/book.txt

      p442272.png

      ×

      30 days

      https://example.com/static/pic.jpg

      ×

      p442272.png

      60 days

      https://example.com/static/res/book.text

      ×

      ×

      Do not cache

Feature availability by plan

Feature category

Detailed feature

Entrance (0 USD/month)

Pro (15 USD/month)

Premium (249 USD/month)

Enterprise (contact sales for custom pricing)

Quick start

Number of nested sub-conditions in rules

10

10

20

20

Operator - Regular expression

Not supported

Not supported

Supported

Supported

HTTPS rules

SSL/TLS rules, HTTPS rules (shared quota)

10

25

50

125

Security rules

5

25

50

125

Transform rules

Rewrite URL, Modify outbound request headers, Modify outbound response headers

10

25

50

125

Managed transform - Real client IP header

Supported

Supported

Supported

Supported

Managed transform - Client geolocation header

Supported

Supported

Supported

Supported

Redirection rules

URL redirection

10

25

50

125

Cache rules

Cache eligibility, Browser cache TTL, Edge cache TTL, Status code cache TTL, Custom cache key

10

25

50

125

Custom port caching

Not supported

Not supported

Not supported

Supported

Response expired cache

Supported

Supported

Supported

Supported

Cache reserve

Supported

Supported

Supported

Supported

Network optimization rules

10

25

50

100

Content optimization rules

File compression, Image optimization, Video processing (shared quota)

10

25

50

100

Origin fetch rules

Number of rules

10

25

50

125

Custom origin Host

Supported

Supported

Supported

Supported

Origin protocol and port

Supported

Supported

Supported

Supported

Origin SNI

Supported

Supported

Supported

Supported

DNS records

Supported

Supported

Supported

Supported

Byte-range segment

Supported

Supported

Supported

Supported

Origin HTTP request timeout

Supported

Supported

Supported

Supported

Configure 301/302 redirect following for origin fetch

Supported

Supported

Supported

Supported