Yes. When a CDN point of presence (POP) returns an HTTP 4xx status code, Alibaba Cloud charges you for the traffic and bandwidth consumed.
Access control features — Referer-based hotlink protection, URL authentication, remote authentication, IP address blacklist or whitelist, and User-Agent blacklist or whitelist — let you block unauthorized requests at the POP. When a request matches a rule, the POP rejects it and returns a 4xx status code. This process consumes two types of resources:
CPU resources — consumed when the POP processes the incoming request
Traffic and bandwidth — consumed when the POP sends back the 4xx response
These resources are consumed regardless of whether the request is authorized, so the charges apply.
If your accelerated domain name receives a large volume of unauthorized requests, unexpected high bills can accumulate even with access control rules in place. To cap your exposure, configure high bill alerts.