Anti-DDoS:Add a website configuration

Scope

• An Anti-DDoS Proxy (Chinese Mainland) or Anti-DDoS Proxy (Outside Chinese Mainland) instance is purchased. For more information, see Purchase an Anti-DDoS Proxy instance.

• To add your website service to an Anti-DDoS Proxy (Chinese Mainland) instance, the website domain name must already have an ICP filing. For more information, see ICP filing.

  Note

  Websites added to Anti-DDoS Proxy (Outside Chinese Mainland) instances are not subject to ICP filing requirements.

Procedure

1. Log on to the Website Config page in the Anti-DDoS Proxy console.

2. In the top navigation bar, select the region of your instance.

   • Anti-DDoS Proxy (Chinese Mainland): Choose the Chinese Mainland region.

   • Anti-DDoS Proxy (Outside Chinese Mainland): Choose the Outside Chinese Mainland region.

3. On the Website Config page, click Add Website.

   Note

   You can also click Batch Import at the bottom of the page to import multiple website configurations at a time. Website configurations are imported in XML format. For more information about the file format, see Other operations.

4. Configure the Website Config information, and then click Next.

   Basic configuration

   • Function Plan: Select the function plan of the Anti-DDoS Proxy instance that you want to associate. Options: Standard and Enhanced.

     Note

     Place the pointer over Function Plan (the icon) to view the feature differences between the Standard function plan and the Enhanced function plan. For more information, see Differences between the standard and enhanced function plans.

   • Instance: Select the Anti-DDoS Proxy instance that you want to associate.

     Important

     A website domain name can be associated with up to 8 Anti-DDoS Proxy instances, and the instances must use the same Function Plan.

   • Websites: Enter the website domain name that you want to protect. Both exact domain names (such as www.example.com) and wildcard domain names (such as *.example.com) are supported.

     Note

     • If both a wildcard domain name and an exact domain name are configured (for example, *.aliyundoc.com and www.aliyundoc.com), Anti-DDoS Proxy gives priority to the forwarding rules and protection policies configured for the exact domain name (that is, www.aliyundoc.com).

     • If you enter a top-level domain name, only the top-level domain name is protected. Subdomains such as second-level domain names are not protected. To protect a second-level domain name, enter the second-level domain name or a wildcard domain name.

     • Only domain names are supported. You cannot enter a website IP address.

   • Protocol Type: Select the protocols that your website supports.

     • HTTP / HTTPS: the basic protocols for websites.

       Note

       For information about HTTPS configurations, see the description of the HTTPS configuration tab

     • Websocket / Websockets: real-time communication protocols. If you select one of these protocols, HTTP or HTTPS is automatically selected.

   • Server Address: Set the address of the backend server (origin server) that Anti-DDoS Proxy requests during a back-to-origin fetch.

     • Origin IP Address: Enter the public IP addresses of the origin server. You can enter multiple IP addresses, separated by commas (,). Examples:

       • Origin server on Alibaba Cloud: In most cases, enter the public IP address of the origin ECS instance. If an SLB instance is deployed in front of the ECS instance, enter the public IP address of the SLB instance.

       • Origin server in a data center outside Alibaba Cloud or on another cloud provider: Use the ping domain name command to query the public IP address to which the domain name resolves, and then enter the public IP address that you obtained.

     • Origin Domain Name:

       • Scenarios: This option applies when another proxy service is deployed between the origin server and Anti-DDoS Proxy. Examples:

         • If the front-end proxy is WAF, you can enter the CNAME address of WAF. For more information, see Protect a website service by using Anti-DDoS Proxy and WAF.

         • If you set Origin Domain Name to the default public endpoint of an Object Storage Service (OSS) bucket, a custom domain name must already be bound to that bucket. For more information, see Map custom domain names.

       • Limits: You can configure up to 10 origin domain names. Separate multiple domain names with line breaks.

   • Server Port: Set the port on which the origin server listens for website service requests.

     • HTTP/Websocket : The default port is 80.

     • HTTPS/Websockets: The default port is 443.

     • Custom server port:

       • Multiple ports: You can specify multiple ports, separated by commas (,). Across all website services that are added to an Anti-DDoS Proxy instance for protection, the total number of custom ports (including custom ports for different protocols) cannot exceed 10.

       • Port range (HTTP/HTTPS): 80 to 65535

   HTTPS configuration

   If you select HTTPS as a protocol that your website supports, complete the following configuration.

   • Configure the certificate:To enable HTTPS, you must configure an SSL certificate that matches the website domain name.

     • Upload: Enter a Certificate Name, and then copy and paste the text content of the certificate file and the private key file into the Certificate File and Private Key fields respectively.

       Note

       • For certificates in the PEM, CER, or CRT format, you can open the certificate file directly in a text editor and copy the text content. For certificates in other formats, such as PFX and P7B, first convert the certificate file to the PEM format. You can then open the file in a text editor and copy the text content. For more information about certificate format conversion, see Convert certificate formats or Convert certificates to PEM format.

       • If the HTTPS certificate has multiple certificate files, such as a certificate chain, you must merge the text content in the certificate chain and paste the merged content into Certificate File.

     • Select Existing Certificate: You can select the certificate directly if it was applied for through Alibaba Cloud Certificate Management Service (Original SSL Certificate) or if you have uploaded it to Certificate Management Service.

   • Configure TLS Security Settings:

     Note

     For more information, see Customize the TLS security policy of a server HTTPS certificate.

     • TLS Versions for SSL Certificate: Select the TLS versions that the international standard HTTPS certificate supports.

       • TLS 1.0 and later. This setting provides the best compatibility but low security.: Supports TLS 1.0, TLS 1.1, and TLS 1.2.

       • TLS 1.1 and later. This setting provides good compatibility and medium security.: Supports TLS 1.1 and TLS 1.2.

       • TLS 1.2 and later. This setting provides good compatibility and high security level.: Supports TLS 1.2.

       • Enable TLS 1.3 Support: Supports TLS 1.3.

     • Cipher Suites for SSL Certificate: Select the cipher suites that the international standard HTTPS certificate supports, or select custom cipher suites. Place the pointer over the icon of a cipher suite option to view the cipher suites that the option includes.

   • Mutual Authentication:

     • Issued by Alibaba Cloud: From the A default CA certificate is required. drop-down list, select a CA certificate that is issued by Alibaba Cloud Certificate Management Service (Original SSL Certificate).

     • Not Issued by Alibaba Cloud:

       • First, upload the self-signed CA certificate to Certificate Management Service (Original SSL Certificate). For more information, see Upload certificate repository (upload a certificate).

       • From the A default CA certificate is required. drop-down list, select the self-signed CA certificate that you uploaded.

   • Enable OCSP Stapling: OCSP stands for Online Certificate Status Protocol. It sends a query request to the certificate authority (CA) that issued the server certificate to check whether the certificate is revoked. During a TLS handshake with the server, the client must obtain both the certificate and the corresponding OCSP response.

     Important

     OCSP responses are digitally signed by the CA and cannot be forged. Therefore, enabling this feature introduces no additional security risks.

     • Disabled (default): The client initiates an OCSP query to the CA itself during the TLS handshake request to verify whether the certificate is revoked. This process blocks the connection and may cause page loading delays when the network is poor.

     • Enabled: Anti-DDoS Proxy performs the OCSP query and caches the result for 3,600 seconds. When a client initiates a TLS handshake request to the server, Anti-DDoS Proxy sends the cached OCSP response to the client together with the certificate chain. This avoids the blocking caused by client-side queries and improves HTTPS performance.

   • SM Certificate: Only Anti-DDoS Proxy (Chinese Mainland) instances support uploading SM-based HTTPS certificates. Only the SM2 algorithm is supported.

     • Allow Access Only from SM Certificate-based Clients: Off by default.

       • On: Processes only requests from clients that have SM certificates installed.

         Note

         After you turn on this feature, the TLS cipher suite, mutual authentication, and Online Certificate Status Protocol (OCSP) stapling settings for the internationally accepted HTTPS certificate do not take effect.

       • Off: Processes requests from clients that have either SM certificates or internationally accepted certificates installed.

     • SM Certificate: You must upload the certificate to Certificate Management Service before you can select it here.

     • SM Cipher Suites for HTTPS Support: The following cipher suites are enabled by default and cannot be modified.

       • ECC-SM2-SM4-CBC-SM3

       • ECC-SM2-SM4-GCM-SM3

       • ECDHE-SM2-SM4-CBC-SM3

       • ECDHE-SM2-SM4-GCM-SM3

   Advanced settings

   • Enable HTTPS Redirection: This setting applies when a website supports both HTTP and HTTPS. After you turn on this setting, all HTTP requests are forcibly converted to HTTPS requests and are redirected to port 443 by default.

     Important

     • You can turn on this setting only if both the HTTP and HTTPS protocols are selected and the Websocket protocol is not selected.

     • If you access a website over a non-standard HTTP port (a port other than 80) and enable forced HTTPS redirection, access requests are redirected to HTTPS port 443 by default.

   • HTTP/2 Listener: If you turn on this switch, clients that use HTTP/2.0 can access Anti-DDoS Proxy. However, Anti-DDoS Proxy still uses HTTP/1.1 to fetch content from the origin server. The HTTP/2.0 specifications are as follows:

     • Basic specifications:

       • Idle timeout after a connection is closed (http2_idle_timeout): 120s

       • Maximum number of requests per connection (http2_max_requests): 1,000

       • Maximum number of concurrent streams per connection (http2_max_concurrent_streams): 4

       • Maximum size of the entire request header list after HPACK decompression (http2_max_header_size): 256K

       • Maximum size of an HPACK-compressed request header field (http2_max_field_size): 64K

     • Configurable specifications: Supports Upper Limit for HTTP/2 Streams, which is the maximum number of concurrent streams allowed between the client and Anti-DDoS Proxy.

   • Set Forward Connection Timeout: The idle timeout period of the persistent TCP connection established between the client and Anti-DDoS Proxy. This is the maximum wait time between two client requests.

     Note

     If no new request arrives within the specified period, Anti-DDoS Proxy closes the connection to release resources.

5. Configure Forwarding Settings, and then click Next.

   Back-to-origin settings

   • Back-to-origin Scheduling Algorithm: If you configure multiple Origin IP Addresses or Origin Domain Names, you can change the back-to-origin load balancing algorithm or set weights for different servers to determine how traffic is distributed among the origin servers.

     Solution	Scenario	How it works
     Round-robin (default)	Multiple origin servers that require a balanced load.	All requests are distributed to all server addresses in turn. By default, all server addresses have the same weight. You can change the server weights. A larger weight indicates a higher probability of receiving requests.
     IP hash	Services that require user session consistency. In extreme cases, the load may be unbalanced.	Requests from the same client IP address are always directed to the same origin server to ensure session consistency. You can set weights for servers while using IP hash to distribute traffic based on server processing capacity and prioritize higher-performance servers.
     Least time	Services that are highly sensitive to access speed and response latency, such as gaming and online transactions.	Uses intelligent DNS resolution and the Least time back-to-origin algorithm to ensure the shortest latency across the whole path from the protection node to the origin server.

   • Retry Back-to-origin Requests: The number of health check probes used to check the availability of the origin server for domain name forwarding. The default value is 3. The back-to-origin retry mechanism works as follows:

     1. Back-to-origin retry is triggered only when service traffic accesses an Anti-DDoS Proxy node. The node retries the back-to-origin request when it detects that the origin server of the domain name is unavailable.

     2. If the origin server is still unreachable after the maximum number of retries, it enters a silent state. During this state, no traffic is forwarded to the origin server and no probes are sent.

     3. After the silent state ends, back-to-origin retry is triggered again based on service traffic. If the retry succeeds, the origin server is reactivated.

   • Traffic Marking:

     • Request Header Forwarding Configuration: Anti-DDoS Proxy supports request header forwarding. You can add or modify HTTP request headers when forwarding requests to your origin server. This helps identify and mark traffic that passes through Anti-DDoS Proxy.

       • Insert X-Client-IP to Get Originating IP Address: Passes the client’s original IP address.

       • Insert X-True-IP to Forward Client IP: Passes the IP address the client used to establish the connection.

       • Insert Web-Server-Type to Get Service Type: Usually added by the first proxy. Tells the backend server which frontend web server or proxy handled the request.

       • Insert WL-Proxy-Client-IP to Get Connection IP: Same function as X-Client-IP. A header specific to Oracle WebLogic Server.

       • X-Forwarded-Proto (Listener Protocol): The protocol used between the client and the first proxy.

     • Traffic marks

       • Default marks

         Note

         • JA3 Fingerprint, JA4 Fingerprint, Client TLS Fingerprint, and HTTP/2 Fingerprint require assistance from your account manager to configure.

         • If your service uses custom fields instead of default marks, see Custom Header below. After you configure it, your origin server parses this field from requests forwarded by Anti-DDoS Proxy. For parsing examples, see Get the true source IP address after configuring Anti-DDoS Proxy.

         • Originating Port: The header field name for the client’s originating port in the HTTP header. Typically recorded in the X-Forwarded-ClientSrcPort field.

         • Originating IP Address: The header field name for the client’s originating IP address in the HTTP header. Typically recorded in the X-Forwarded-For field.

         • JA3 Fingerprint: The name of the HTTP header field that contains the MD5 hash of the client's JA3 fingerprint. The default field is ssl_client_ja3_fingerprinting_md5.

         • JA4 Fingerprint: The name of the HTTP header field that contains the MD5 hash of the client's JA4 fingerprint. The default field is ssl_client_ja4_fingerprinting_md5.

         • Client TLS Fingerprint: The name of the HTTP header field that contains the MD5 hash of the client's TLS fingerprint. The default field is ssl_client_tls_fingerprinting_md5.

         • HTTP/2 Fingerprint: The header field name for the MD5 hash value generated from the client HTTP/2.0 fingerprint in the HTTP header. Typically recorded in the http2_client_fingerprint_md5 field.

       • Custom Header: Add a custom HTTP header (including field name and value) to mark requests that pass through Anti-DDoS Proxy. When Anti-DDoS Proxy forwards website traffic, it adds the configured field value to requests sent to your origin server. This helps your backend service analyze and track traffic.

         • Naming restrictions: To avoid overwriting original request header fields, do not use the following reserved or common field names for your custom header:

           • Anti-DDoS Proxy default fields:

             • X-Forwarded-ClientSrcPort: Used by default to get the client port for Layer 7 engine access.

             • X-Forwarded-ProxyPort: Used by default to get the listening port for Layer 7 engine access.

             • X-Forwarded-For: Used by default to get the client IP address for Layer 7 engine access.

             • ssl_client_ja3_fingerprinting_md5: Used by default to retrieve the MD5 hash of the client's JA3 fingerprint.

             • ssl_client_ja4_fingerprinting_md5: Used by default to retrieve the MD5 hash of the client's JA4 fingerprint.

             • ssl_client_tls_fingerprinting_md5: Used by default to retrieve the MD5 hash of the client's TLS fingerprint.

             • http2_client_fingerprint_md5: Used by default to get the MD5 hash value of the client HTTP/2.0 fingerprint.

           • Standard HTTP fields: Such as host, user-agent, connection, and upgrade.

           • Common proxy fields: Such as x-real-ip, x-true-ip, x-client-ip, web-server-type, wl-proxy-client-ip, eagleeye-rpcid, eagleeye-traceid, x-forwarded-cluster, and x-forwarded-proto.

         • Quantity limit: You can add up to five custom header labels.

         • Configuration recommendations:

           • Use default marks first.

           • Verify the header field configuration in the staging environment before applying it to the production environment.

           • We recommend keeping field values to 100 characters or less to avoid affecting forwarding performance.

   • CNAME Reuse: Select whether to enable CNAME reuse. After you enable CNAME reuse, you can add multiple domain names hosted on the same server to Anti-DDoS Proxy by pointing their DNS records to the same Anti-DDoS Proxy CNAME address. You do not need to add a separate website configuration for each domain name. For more information, see CNAME reuse.

     Important

     Only Anti-DDoS Proxy (Outside Chinese Mainland) supports this parameter.

   Other settings

   • Enable HTTP Redirection of Back-to-origin Requests: If your website does not support HTTPS back-to-origin requests, you must turn on this setting. After you turn on this setting, all HTTPS requests are forwarded to the origin server over HTTP, all Websockets requests are forwarded over Websocket, and the default back-to-origin port is 80.

     Note

     If you access a website over a non-standard HTTPS port (a port other than 443) and enable HTTP back-to-origin requests, access requests are redirected to HTTP port 80 of the origin server by default.

   • HTTP/2.0 Origin: After you enable HTTP/2.0 back-to-origin requests, Anti-DDoS Proxy forwards requests to the origin server over HTTP/2.0.

     Warning

     • To configure this feature, contact your account manager.

     • If your origin server does not support HTTP/2.0, do not configure this feature. Otherwise, the website cannot be accessed.

   • Cookie Settings

     • Delivery Status: Enabled by default. Anti-DDoS Proxy sets a cookie on the client (such as a browser) to distinguish and count different clients or to obtain client fingerprint information. For details, see Configure HTTP flood protection.

       Important

       If your application experiences login crashes or session loss after it is added to Anti-DDoS Proxy, you can try turning off this switch. Note that some HTTP flood protection features do not take effect after you turn it off.

     • Secure Attribute: Disabled by default. If you turn on this setting, cookies are sent only over HTTPS connections and not over HTTP connections. This helps protect cookies from being stolen by attackers.

       Note

       If your website service supports only HTTPS connections, we recommend that you turn on this setting.

   • Configure New Connection Timeout Period: The time that Anti-DDoS Proxy waits to establish a connection to the origin server.

     Note

     If the connection is not established within this period, the attempt is considered a failure.

   • Configure Read Connection Timeout Period: The maximum time that Anti-DDoS Proxy waits for the origin server to return response data after a connection is established and a read request is sent to the origin server.

   • Configure Write Connection Timeout Period: The time that Anti-DDoS Proxy waits after data is sent from Anti-DDoS Proxy and before the origin server starts processing the data.

     Note

     If Anti-DDoS Proxy fails to send all the data to the origin server, or the origin server does not start processing the data within this period, the attempt is considered a failure.

   • Back-to-origin Persistent Connections: A TCP connection between a cache server and an origin server remains active for a period of time instead of closing after each request, which wastes resources. Turn on Back-to-origin Persistent Connections to reduce the time and resources consumed by connection establishment and to improve the efficiency and speed of request processing.

     • Requests Reusing Persistent Connections: The number of HTTP requests that can be sent over a single TCP connection that Anti-DDoS Proxy establishes to the origin server. This reduces the latency and resource consumption caused by frequently establishing and closing connections.

       Note

       Set this value to be less than or equal to the number of requests per persistent connection configured on the backend origin server, such as a WAF or SLB instance. This prevents service inaccessibility caused by connection termination.

     • Timeout Period of Idle Persistent Connections: The maximum time that a persistent TCP connection established by Anti-DDoS Proxy to the origin server remains open in the Anti-DDoS Proxy connection pool after no data is transferred. If no new request arrives during this period, the connection is closed to release system resources.

       Note

       Set this value to be less than or equal to the timeout period configured on the backend origin server, such as a WAF or SLB instance. This prevents service inaccessibility caused by connection termination.

Verify and go live

After you complete the website configuration, follow this checklist to verify the configuration and go live. This helps you avoid service interruptions.

• Core operations (required)

  1. Allow back-to-origin IP addresses: In the security policies of the origin server (such as firewalls and security groups), allow the back-to-origin CIDR blocks of Anti-DDoS Proxy by adding them to the allowlist. This prevents traffic that Anti-DDoS Proxy forwards to the origin server from being blocked by mistake. For more information, see Add back-to-origin IP addresses to allowlist.

  2. Verify the configuration locally: Before you switch the DNS record, modify the local hosts file to verify that the Anti-DDoS Proxy forwarding configuration works as expected. This helps you avoid service interruptions. For more information, see Locally validate your forwarding configuration.

  3. Switch the DNS record: After the local verification succeeds, change the DNS record of the website domain name to the CNAME address provided by Anti-DDoS Proxy. This switches your service traffic to Anti-DDoS Proxy for protection. For more information, see Point a domain name to Anti-DDoS Proxy.

• Optional operations

  • Change the origin IP address: If your origin server is an Alibaba Cloud ECS instance and the origin IP address is accidentally exposed, we recommend that you change the public IP address of the ECS instance. This prevents attackers from bypassing Anti-DDoS Proxy to attack the origin server directly. For more information, see Static public IP addresses.

  • Configure DDoS mitigation policies: In addition to the default protection policies of Anti-DDoS Proxy (Anti-DDoS Global Mitigation Policy, Intelligent Protection, and Frequency Control), you can turn on more protection features on the Protection for Website Services tab as needed. For more information, see Website service DDoS protection.

    Important

    Enabling an HTTP flood protection policy may set cookies on clients. For details, see Cookie insertion.

  • Configure Cloud Monitor alerts: Set alert rules for common service metrics of Anti-DDoS Proxy, such as IP traffic and connections, and for attack events, such as blackhole filtering and scrubbing events. Alerts are sent promptly when an anomaly occurs on Anti-DDoS Proxy, which helps you respond quickly to abnormal events. For more information, see CloudMonitor Alerts.

  • Configure the full log service: Enable the log service to collect and store website access logs (180 days by default) for business analysis and to meet classified protection compliance requirements. For more information, see Get started with Log Analysis.

Quotas and limits

• A website domain name can be associated with up to 8 Anti-DDoS Proxy instances.

• Across all website configurations under one Anti-DDoS Proxy instance, the total number of custom ports (other than 80 and 443) cannot exceed 10.

• You can add up to 5 Custom Header labels.

References

FAQ

• Why do 502 or 504 errors occur when I access the website after the configuration is complete?

  This is usually caused by a back-to-origin failure. Troubleshoot in the following order:

  1. Check the firewall or security group of the origin server: Verify that the back-to-origin CIDR blocks of Anti-DDoS Proxy are added to the allowlist.

  2. Check the “HTTP back-to-origin” setting: If your origin server supports only HTTP (listening on port 80) but you configured HTTPS in Anti-DDoS Proxy without enabling “HTTP back-to-origin”, the back-to-origin request fails.

  3. Check the status of the origin server: Verify that the Origin IP Address you entered is correct and that the origin server itself is running as expected.

• Why does the browser report a certificate error after HTTPS is enabled? 

  Check the following items:

  1. The certificate does not match the domain name: Make sure that the certificate covers the domain names that you added, including www and the root domain name. For example, a certificate issued for www.example.com cannot be used for example.com unless it is a wildcard or multi-domain certificate.

  2. The certificate chain is incomplete: When you upload a certificate, make sure that you concatenate and upload the complete certificate chain (server certificate + intermediate CA certificate).

  3. The certificate has expired: Check whether the certificate that you uploaded is still within its validity period.

• How do I verify that website traffic passes through Anti-DDoS Proxy? 

  1. DNS query: On the command line, run ping <your domain name> or dig <your domain name> and check whether the resolved address is the CNAME address of Anti-DDoS Proxy or the IP address that it points to.

  2. Console reports: On the report page of the Anti-DDoS Proxy console, check whether inbound traffic data is displayed.

  3. Origin server logs: Check the web access logs of your origin server to verify whether the source IP addresses of requests belong to the back-to-origin CIDR blocks of Anti-DDoS Proxy.

• Why do my application logs record only the IP address of Anti-DDoS Proxy, and how do I obtain the real visitor IP address? 

  This is expected. As a proxy, Anti-DDoS Proxy accesses your origin server from its back-to-origin IP addresses. To obtain the real visitor IP address, configure your web server (such as Nginx or Apache) to extract the IP address from the X-Forwarded-For request header. For more information about the configuration, see Obtain originating IP addresses behind Anti-DDoS Proxy.

• Can visitors still access a website that is added to Anti-DDoS Proxy after the IP address of the origin server enters a blackhole state?

  For websites that already have a website configuration on the Website Config page, access traffic uses proxy-based back-to-origin forwarding: traffic first reaches Anti-DDoS Proxy, which then forwards the traffic to the origin server. This works like a reverse proxy. Therefore, when the IP address of the origin server enters a blackhole state, website access traffic is still forwarded to the origin server through Anti-DDoS Proxy, and the origin server responds and returns the pages. This mitigates the impact of blackhole filtering on your service to some extent. In addition, after you add your website to Anti-DDoS Proxy, you can apply to deactivate blackhole filtering.

• How do I verify the protection effectiveness of Anti-DDoS Proxy?

  Note: Blackhole filtering is a protection mechanism that the system triggers automatically when a volumetric DDoS attack exceeds the mitigation threshold. You cannot trigger it manually. To verify the traffic scrubbing and forwarding effectiveness of Anti-DDoS Proxy, use the following methods:

  1. Add a test service (not a production service) to Anti-DDoS Proxy. Do not use a production service for testing.

  2. Use a stress testing tool to simulate DDoS traffic and observe the traffic scrubbing and forwarding behavior of Anti-DDoS Proxy.

  3. On the Anti-DDoS Proxy console, view the protection data and traffic scrubbing results on the Reports page.

  4. Check the web access logs of the origin server to verify that the source IP addresses of requests belong to the back-to-origin CIDR blocks of Anti-DDoS Proxy.